CVE-2018-25135

Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS probability

0.08%

CWE

CWE-149

Published

2025-12-24

Last modified

2026-03-14

Affected products

• Anviz Biometric Technology Co., Ltd. Anviz AIM CrossChex Standard

Weakness type

• CWE-149

Related vulnerabilities

• CVE-2026-42511 — Remote code execution via malicious DHCP options
• CVE-2025-43878 — F5OS-A/C CLI vulnerability
• CVE-2025-1094 — PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
• CVE-2023-36479 — Jetty vulnerable to errant command quoting in CGI Servlet

Markdown version · Browse all CVEs