Posted by Ron E on Aug 18nopCommerce versions v4.10 and v4.80.3 are vulnerable to CSV Injection (Formula Injection) when exporting data to CSV. The application does not properly sanitize user-supplied input before including it in CSV export files. An attacker can inject malicious spreadsheet formulas into fields that will later be exported (for example, order details, product names, or customer information). When the exported file is opened in spreadsheet software...