PT-2025-34444 · Unopim+1 · Unopim+1

Sn1P3Rt3S7 · Published 2025-08-22 · Updated 2025-08-22 · CVE-2025-55745

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: UnoPim versions prior to 0.3.1

Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and prior are susceptible to CSV injection, also known as formula injection, in the Quick Export feature. This allows attackers to inject malicious content into exported CSV files. When opened in spreadsheet applications like Microsoft Excel, the malicious input may be interpreted as a formula or command, potentially leading to the execution of arbitrary code on the victim’s device. Successful exploitation can lead to remote code execution, including the establishment of a reverse shell.

Recommendations: Upgrade to version 0.3.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2025-55745

GHSA-74RG-6F92-G6WX

Affected Products

Office Excel

Unopim

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55745.json · Exploit
• https://osv.dev/vulnerability/GHSA-74rg-6f92-g6wx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55745 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55745 · Security Note
• https://github.com/unopim/unopim/commit/8325b78567411ad78d44c0385f192360e608ff71 · Note
• https://github.com/unopim/unopim/security/advisories/GHSA-74rg-6f92-g6wx · Note
• https://github.com/unopim/unopim/commit/b25db9496fc147842a519d1dd42ec03c3bf00a34 · Note
• https://github.com/unopim/unopim · Note
• https://twitter.com/CVEnew/status/1958933872546029907 · Twitter Post
• https://t.me/CVEtracker/30703 · Telegram Post
• https://drive.proton.me/urls/3TP1QEMXNC#2PAy7OkVqdP3 · Note