CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.