CVE-2020-36962

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-36962
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36962.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-36962
Published
2026-01-28T18:16:46.277Z
Modified
2026-03-14T10:30:25.519582Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.

References

Affected packages

Git / github.com/tendenci/tendenci

Affected ranges

Type
GIT
Repo
https://github.com/tendenci/tendenci
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
103d24439498b3cc24c4588900819a5ba1cb807e
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "12.3.1"
        }
    ]
}

Affected versions

11.*
11.4.3
v11.*
v11.0
v11.0.1
v11.0.2
v11.0.3
v11.0.4
v11.0.5
v11.0.6
v11.0.7
v11.0.8
v11.1
v11.1.1
v11.1.2
v11.2
v11.2.1
v11.2.10
v11.2.11
v11.2.12
v11.2.2
v11.2.3
v11.2.4
v11.2.5
v11.2.6
v11.2.7
v11.2.8
v11.2.9
v11.3
v11.3.1
v11.4
v11.4.1
v11.4.10
v11.4.2
v11.4.4
v11.4.5
v11.4.6
v11.4.7
v11.4.8
v11.4.9
v12.*
v12.0
v12.0.1
v12.0.10
v12.0.11
v12.0.12
v12.0.13
v12.0.14
v12.0.2
v12.0.3
v12.0.4
v12.0.5
v12.0.6
v12.0.7
v12.0.8
v12.0.9
v12.1
v12.1.1
v12.2
v12.2.1
v12.2.2
v12.2.3
v12.2.5
v12.2.6
v12.2.7
v12.2.8
v12.3
v12.3.1
v7.*
v7.1.23
v7.1.24
v7.1.25
v7.1.26
v7.1.27
v7.2.0
v7.2.77
v7.2.78
v7.2.79
v7.2.80
v7.2.81
v7.3.0
v7.3.1
v7.3.2
v7.3.3
v7.3.8
v7.4.0
v7.4.2
v7.4.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36962.json"