CVE-2025-54757 | Medium | 6.5 | 2025-07-31 | Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an… |
CVE-2025-54752 | Medium | 6.5 | 2025-07-31 | Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it… |
CVE-2025-46359 | High | 7.2 | 2025-07-31 | A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a… |
CVE-2025-41396 | Medium | 5.4 | 2025-07-31 | A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user. |
CVE-2025-41391 | Medium | 5.4 | 2025-07-31 | Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be exec… |
CVE-2025-36563 | Medium | 6.1 | 2025-07-31 | Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script ma… |
CVE-2025-29993 | Medium | 5.3 | 2025-03-27 | The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered… |
CVE-2023-50297 | Medium | 6.1 | 2023-12-26 | Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites vi… |
CVE-2023-49117 | Medium | 5.4 | 2023-12-26 | PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may b… |
CVE-2022-33941 | Critical | 9.8 | 2022-09-08 | PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC… |
CVE-2021-20850 | Critical | 9.8 | 2021-11-24 | PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remo… |
CVE-2019-6020 | Medium | 6.1 | 2019-12-26 | Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote at… |