CVE-2022-1544

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
luyadev	luyadev/yii-helpers	>= unspecified, < 1.2.1

References

https://github.com/luyadev/yii-helpers/commit/9956ed63f516110c2b588471507b870e748c4cfbPatch, Third Party Advisory
https://huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4Exploit, Patch, Third Party Advisory
https://github.com/luyadev/yii-helpers/commit/9956ed63f516110c2b588471507b870e748c4cfbPatch, Third Party Advisory
https://huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4Exploit, Patch, Third Party Advisory

Timeline

Published: May 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-15454.3It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8 CVE-2022-15466.1The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back i CVE-2022-15476.1The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an CVE-2022-15488.8Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate th CVE-2022-15495.4The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the val CVE-2022-15516.5The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that CVE-2022-15528.8A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another us CVE-2022-15534.9Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers ca CVE-2022-15547.5Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.CVE-2022-15556.1DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal CVE-2022-15569.8The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when search CVE-2022-15575.4The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and i