CVE-2025-55745 - CVE House
Back to Database
Status published Low CVE-2025-55745

UnoPim Quick Export feature is vulnerable to CSV injection

Vulnerability Description

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and prior are vulnerable to CSV injection, also known as formula injection, in the Quick Export feature. This vulnerability allows attackers to inject malicious content into exported CSV files. When the CSV file is opened in spreadsheet applications such as Microsoft Excel, the malicious input may be interpreted as a formula or command, potentially resulting in the execution of arbitrary code on the victim's device. Successful exploitation can lead to remote code execution, including the establishment of a reverse shell. Users are advised to upgrade to version 0.3.1 or later.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55745

Credits & Attribution

No credits recorded in the NVD database.

References

More from unopim

View All →
CVE-2025-55744
UnoPim vulnerable to CSRF on Product edit feature and creation of other types
Medium 6.9
CVE-2025-55743
UnoPim vulnerable to remote code execution through Arbitrary File upload
High 7.3
CVE-2025-55742
UnoPim Stored XSS via SVG MIME/Sanitizer Bypass
High 8
CVE-2025-55741
unopim/unopim allows unauthorized product deletion via mass-delete endpoint
High 8.1
CVE-2024-52305
UnoPim Stored XSS : Cookie hijacking through Create User function
Medium 6.5

Affected Vendor

Affected Software

unopim
Vulnerable Versions:
< 0.3.1

Timeline

Official Publish: August 22nd, 2025
Last Modified: August 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1236

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.