CVE-2025-9241

A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

EPSS probability

0.32%

CWE

CWE-1236, CWE-74

Published

2025-08-20

Last modified

2026-03-12

Affected products

• elunez eladmin
• elunez eladmin
• elunez eladmin
• elunez eladmin
• elunez eladmin
• elunez eladmin
• elunez eladmin
• elunez eladmin

Weakness type

• CWE-1236
• CWE-74

Related vulnerabilities

• CVE-2026-86745 — Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
• CVE-2026-86742 — Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
• CVE-2026-79971 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
• CVE-2026-86257 — wger before 2.6 CSV Formula Injection via member export
• CVE-2026-9852 — A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data...
• CVE-2026-76797 — MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports
• CVE-2026-56652 — Formula Injection in dool project
• CVE-2026-78209 — exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

Markdown version · Browse all CVEs