CVE-2026-12862

MediumCVSS 5.1/10Last modified Jun 23, 2026

Description

Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-148

Affected software

No affected versions have been published.

Timeline

Published: Jun 22, 2026
Last modified: Jun 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-128635.1An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.CVE-2026-128657.1The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribut CVE-2026-128669.8All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScr CVE-2026-128696.1The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard templa CVE-2026-12875.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in col CVE-2026-128729.8The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any auth CVE-2026-128779.1The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before CVE-2026-128788.8In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.CVE-2026-128795.9An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allo CVE-2026-12885.5A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference CVE-2026-128824.3Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatche CVE-2026-128882.0An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Inte