CVE-2023-53913: Rukovoditel

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV file.

Affected products

• Rukovoditel Rukovoditel: version 3.3.1 only

Published 2025-12-17. Last modified 2026-06-17.