phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents.
{ "cpes": [ "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*" ], "severity": "High" }