Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2018-25135: Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import
CVE-2018-25135 · published 10 months ago
Summary
Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing use...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| anviz biometric technology co., ltd. | anviz aim crosschex standard | 4.3 |
Original advisory text
Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import
Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.
References
- https://www.exploit-db.com/exploits/45765 exploit
- https://www.anviz.com product
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php third-party-advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-149Improper Neutralization of Quoting Syntax
Timeline
Published24 Dec 2025
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta