CVE-2023-54348: Rajodiya Erpgo Saas

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the workstation of users who open the exported CSV in a spreadsheet application. Attackers can add malicious formulas like =10+20+cmd|' /C calc'!A0 in the vendor creation form, which execute when the exported CSV file is opened in spreadsheet applications.

Affected products

• Rajodiya Erpgo Saas: version 3.9 only

Published 2026-05-05. Last modified 2026-06-17.