PT-2025-53355 · Undefined · Undefined

Published 2025-12-24 · Updated 2025-12-24 · CVE-2018-25135

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.

Fix

Weakness Enumeration

CWE-149

Related Identifiers

CVE-2018-25135

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-25135 · Security Note
• https://exploit-db.com/exploits/45765 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php · Note
• https://anviz.com · Note