Description
In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Excel). For example, the CSV data may contain untrusted user input from the "First Name" field of a user's /myprofile page.
Remediation
References
Related Vulnerabilities
WordPress Plugin Site Offline Or Coming Soon Or Maintenance Mode Security Bypass (1.5.2)
MySQL CVE-2018-3174 Vulnerability (CVE-2018-3174)
WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk SQL Injection (5.153.3)
Drupal Core 7.x Security Bypass (7.0 - 7.87)
WordPress Plugin Qwizcards-online quizzes and flashcards Cross-Site Scripting (3.36)