Alfasado: >> Powercms >> 5.25 Security Vulnerabilities
A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.
CVSS Score
7.2
EPSS Score
0.001
Published
2025-07-31
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-07-31
Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-07-31
Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser.
CVSS Score
5.4
EPSS Score
0.0
Published
2025-07-31
A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user.
CVSS Score
5.4
EPSS Score
0.001
Published
2025-07-31
Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed on the browser.
CVSS Score
6.1
EPSS Score
0.0
Published
2025-07-31