Is CVE-2020-25445 actively exploited?

No active exploitation of CVE-2020-25445 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-25445 be exploited remotely?

No. CVE-2020-25445 requires local access to exploit.

What is the CVSS score of CVE-2020-25445?

CVE-2020-25445 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2020-25445

HIGH

CVE-2020-25445

CWE-1236Published: July 14, 2021· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed.

NVD Source

Technical Analysis

CVE-2020-25445 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.