CVE-2020-36941

CRITICAL

9.8

Descripcion

Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet applications.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado1/27/2026

Ultima modificacion3/24/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

guelfoweb:knockpy

Debilidades (CWE)

CWE-1236

Referencias

https://github.com/guelfoweb/knock(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/49342(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/knockpy-csv-injection(disclosure@vulncheck.com)

https://github.com/guelfoweb/knock(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.