CVE-2020-36962 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during expor…
Medium CVSS: 5.3

CVE-2020-36962

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.
Vendor
Tendenci
Product
Tendenci
CWE
CWE-1236
Yayın Tarihi
2026-01-28 18:16:46
Güncelleme
2026-02-02 19:13:52
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-

Kategoriler

CWE-1236 Tendenci MEDIUM Tendenci 2026

Referanslar

https://github.com/tendenci/tendenci https://www.exploit-db.com/exploits/49145 https://www.tendenci.com/ https://www.vulncheck.com/advisories/tendenci-csv-formula-injection https://www.exploit-db.com/exploits/49145