Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12468
Reference (s):
- https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/CSV%20Injection