CVE-2020-28848 - CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file

HIGH

CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file

Published Aug 11, 2023

8.8

HIGH

CVSS 3.1

EPSS 1.12%

CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file.

No remediation recorded yet.

Weaknesses (1)

CWE-74

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21240		Advisory
https://github.com/ChurchCRM/CRM/issues/5465		ExploitIssue Tracking

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Aug 11, 2023

Updated Oct 9, 2024

Reserved Nov 16, 2020

Updated Oct 9, 2024

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a

Assigner mitre

Published Aug 11, 2023

Updated Oct 9, 2024

Exploited since n/a