https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T19:03:59.781440+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-109396 CVE-2026-109396 — Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports 2026-10-15T19:03:59.783171+00:00

Affected: Thelia

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.