UNKNOWN NVD

CVE-2026-19501

CSV export functionality in Brainstorm Force SureForms version, <= 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names

CSV export functionality in Brainstorm Force SureForms version, <= 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.

References

http://sureforms.com
https://github.com/typedefabcd1234ntd/CVE-2026-19501-poc

Published: 2026-08-18 · Source: NVD · Feed updated: 2026-08-18

This unknown severity vulnerability was published on 2026-08-18 via NVD.

vulnfeed aggregates 11140 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.