CVE-2018-25135

critical · 9.3

Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.

9.3

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2025-12-24

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-149

References

https://www.anviz.com
https://www.exploit-db.com/exploits/45765
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php
https://www.exploit-db.com/exploits/45765
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-25135