CVE-2026-47693

Name of the Vulnerable Software and Affected Versions Poweradmin versions prior to 4.2.4 Poweradmin versions prior to 4.3.3 Poweradmin version 4.4.0

Description The log export functionality is susceptible to CSV Injection (Formula Injection), which occurs when user-controlled data is written to exported CSV files without sanitizing formula trigger characters such as =, +, -, and @. Specifically, the username field is written verbatim to the output. When an administrator opens the resulting CSV file in spreadsheet applications like Microsoft Excel, LibreOffice Calc, or Google Sheets, any formula stored in a username is executed. This can facilitate phishing attacks against administrators or lead to data exfiltration using functions like =IMPORTXML(). The issue exists in the following controllers:

Recommendations Update to version 4.2.4. Update to version 4.3.3. At the moment, there is no information about a newer version that contains a fix for this vulnerability.