CVE-2018-9035

CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.

• CWE-1236

• https://www.exploit-db.com/exploits/44367/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44367/Exploit, Third Party Advisory, VDB Entry

Published

Apr 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9027A reflected cross-site scripting vulnerability in CA Privile…
• CVE-2018-9028Weak cryptography used for passwords in CA Privileged Access…
• CVE-2018-9029An improper input validation vulnerability in CA Privileged …
• CVE-2018-9031The login interface on TNLSoftSolutions Sentry Vision 3.x de…
• CVE-2018-9032An authentication bypass vulnerability on D-Link DIR-850L Wi…9.8
• CVE-2018-9034Cross-site scripting (XSS) vulnerability in lib/interface.ph…
• CVE-2018-9036CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Logi…
• CVE-2018-9037Monstra CMS 3.0.4 allows remote code execution via an upload…
• CVE-2018-9038Monstra CMS 3.0.4 allows remote attackers to delete files vi…
• CVE-2018-9039In Octopus Deploy 2.0 and later before 2018.3.7, an authenti…
• CVE-2018-9040In Advanced SystemCare Ultimate 11.0.1.58, the driver file (…
• CVE-2018-9041In Advanced SystemCare Ultimate 11.0.1.58, the driver file (…