CVE-2018-25135
Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 24, 2025
- Updated
- Oct 1, 2026
- Reserved
- Dec 24, 2025
Description
Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-149 Improper Neutralization of Quoting Syntax
Affected Products
| Product | Versions |
|---|---|
Anviz AIM CrossChex StandardAnviz Biometric Technology Co., Ltd. |
|
References
- ExploitDB-45765exploit
- Anviz Biometric Technology Product Homepageproduct
- Zero Science Lab Disclosure (ZSL-2018-5498)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.