CVE-2026-19501PoC

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1236

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

PoC

1100.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-19501

Full discourse1 post

Vulmon Vulnerability Feed@VulmonFeeds46d
PoC
CVE-2026-19501 CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-19501
Post summary
The post announces an unauthenticated CSV injection vulnerability (CVE‑2026‑19501) in Sureforms, states a PoC exists, but does not provide exploit code, active exploitation evidence, or patch details.
00000125
4.1K followersView on X

Explore more

Back to dashboard