CyberSec.Space Logo
返回 CVE 浏览器

CVE-2018-25135

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0420%
EPSS Percentile10.95th
Published2025年12月24日
Last Modified2026年4月15日

Vulnerability Description

Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 https://www.anviz.com
🔗 https://www.exploit-db.com/exploits/45765
🔗 https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php
🔗 https://www.exploit-db.com/exploits/45765
🔗 https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php

相关漏洞威胁

CVE-2018-1904710.0

mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="htt...

CVE-2018-1941710.0

An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH me...

CVE-2018-1874810.0

Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), with...

CVE-2018-1716010.0

In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models provided by b...