{"id":"CVE-2018-20468","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-20468","generatedAt":"2026-10-28T21:22:31.020Z","title":"A web reports module has \"export to excel features\" that are vulnerable to CSV injection.","description":"An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has \"export to excel features\" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution.","published":"2019-06-17T14:15:10.000Z","lastModified":"2026-06-17T01:52:54.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-1236"],"affected":["sahipro/sahi pro"],"epss":{"score":0.02223,"percentile":0.82605,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (2.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://barriersec.com/2019/06/cve-2018-20468-sahi-pro/","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://barriersec.com/2019/06/cve-2018-20468-sahi-pro/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-20468","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}