CVE-2022-1202

CVE-2022-1202: WP-CRM <= 1.2.1 - CSV Injection

Vendor Unknown

Product WP-CRM – Customer Relations Management for WordPress

Weakness CWE-1236

Published June 13, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.

Key dates

02Disclosure timeline

June 13, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1202 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1236.html

Related vulnerabilities

04Related CVE

CVE-2023-48709 iTop vulnerable to potential formula injection in Excel/CSV export file CVE-2022-3393 Post to CSV by BestWebSoft <= 1.4.0 - Author+ CSV Injection CVE-2022-46803 WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection CVE-2023-53929 phpMyFAQ 3.1.12 CSV Injection via User Profile Export CVE-2022-4034 Appointment Hour Booking <= 1.3.72 - CSV Injection