https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:13:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329861 EUVD-2026-329861 https://cve.radiocsirt.org/vuln/euvd-2026-329861 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47693 <p>Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions 4.2.4 and 4.3.3 patch the issue.</p> <p>Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions 4.2.4 and 4.3.3 patch the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47693 https://cve.radiocsirt.org/vuln/ghsa-3h6h-67x3-cv5x <p><strong>Affected:</strong> Packagist: poweradmin/poweradmin</p> <p>Description:</p> <p>### Summary</p> <p>Poweradmin v4.4.0 is vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration.</p> <p>### Details</p> <p>The vulnerability exists in all four log export controllers:</p> <p>- `lib/Application/Controller/ListLogUsersController.php` (lines 188, 194) - `lib/Application/Controller/ListLogZonesController.php` - `lib/Application/Controller/ListLogGroupsController.php` - `lib/Application/Controller/ListLogApiController.php`</p> <p>These controllers export database rows via `fputcsv()` without applying any formula injection countermeasures. The `user` column contains the username of the actor who performed the operation, and the `username` column (in user logs) contains the username of the affected account. Both fields are written verbatim to the CSV output.</p> <p>A username such as `=1+1` is written **without CSV enclosure quotes** (because it contains no commas or quotes), so spreadsheet applications treat it directly as a formula. A username containing commas or quotes (e.g. `=HYPERLINK(&#34;http://attacker.com&#34;,&#34;Click h…</p> <p><strong>Affected:</strong> Packagist: poweradmin/poweradmin</p> <p>Description:</p> <p>### Summary</p> <p>Poweradmin v4.4.0 is vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration.</p> <p>### Details</p> <p>The vulnerability exists in all four log export controllers:</p> <p>- `lib/Application/Controller/ListLogUsersController.php` (lines 188, 194) - `lib/Application/Controller/ListLogZonesController.php` - `lib/Application/Controller/ListLogGroupsController.php` - `lib/Application/Controller/ListLogApiController.php`</p> <p>These controllers export database rows via `fputcsv()` without applying any formula injection countermeasures. The `user` column contains the username of the actor who performed the operation, and the `username` column (in user logs) contains the username of the affected account. Both fields are written verbatim to the CSV output.</p> <p>A username such as `=1+1` is written **without CSV enclosure quotes** (because it contains no commas or quotes), so spreadsheet applications treat it directly as a formula. A username containing commas or quotes (e.g. `=HYPERLINK(&#34;http://attacker.com&#34;,&#34;Click h…</p> https://cve.radiocsirt.org/vuln/ghsa-3h6h-67x3-cv5x