https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 02:50:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-344112 EUVD-2026-344112 https://cve.radiocsirt.org/vuln/euvd-2026-344112 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18738 <p>Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator&#39;s client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.</p> <p>Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator&#39;s client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18738 https://cve.radiocsirt.org/vuln/ghsa-ghrv-q878-w45x <p>Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator&#39;s client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.</p> <p>Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering characters such as =, +, -, or @. Attackers can craft a single unauthenticated request against any short URL to embed DDE or WEBSERVICE formula payloads into CSV cells, which are then executed on an administrator&#39;s client machine when the exported CSV file is opened in a spreadsheet application that evaluates formulas.</p> https://cve.radiocsirt.org/vuln/ghsa-ghrv-q878-w45x