CVE-2022-33941

CVE-2022-33941 : PowerCMS XMLRPC API from Alfasado Inc. contains a command injection vulnerability reachable via POST requests, allowing arbitrary Perl script execution and potentially arbitrary OS commands. Affected: PowerCMS 6.021 and earlier, 5.21 and earlier, 4.51 and earlier; developer notes...

CVE-2021-20850

CVE-2021-20850 affects PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (EOL). The vulnerability is an OS command injection through the PowerCMS XMLRPC API, allowing a remote attacker to execute arbitrary commands. The XMLRPC API usage (mt-xm...

CVE-2023-50297

PowerCMS Open Redirect (CVE-2023-50297) affects PowerCMS 4 Series, 5 Series, and 6 Series (PowerCMS 4.54 and earlier; 5.24 and earlier; 6.31 and earlier). The root cause is an open redirect that allows a remote, unauthenticated attacker to redirect users to arbitrary websites via a specially craf...

CVE-2019-6020

Open redirect vulnerability (CWE-601) in PowerCMS affects versions 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x). A specially crafted URL can redirect users to arbitrary websites, enabling phishing risk. Reported across multiple sources (NV...

CVE-2023-49117

PowerCMS (PowerCMS 4–6 Series; and 3 Series/EOL are affected) contains a stored cross-site scripting vulnerability (CVE-2023-49117) in the management screen. Exploitation could trigger arbitrary script execution in a logged-in user’s browser. Affected versions per JVN/Red Hat notes include PowerC...

CVE-2025-46359

CVE-2025-46359 : A path traversal flaw in the backup/restore feature of multiple PowerCMS versions allows an administrator to execute arbitrary code by restoring a crafted backup file. The vulnerability affects the backup/restore component (no version numbers specified in sources). Remediation is...

CVE-2025-54757

CVE-2025-54757 affects PowerCMS. Unrestricted upload of files allows a product user-uploaded file to contain dangerous content, potentially enabling an arbitrary script when an administrator opens the malicious file in the browser. The root issue is unsafe handling of file uploads that can be man...

CVE-2025-36563

CVE-2025-36563 is a reflected cross-site scripting vulnerability affecting PowerCMS in multiple versions. Exploitation requires a user (administrator or general user per vector) to access a crafted URL, allowing arbitrary script execution in the browser. CVSS metrics specify MEDIUM severity (olde...

CVE-2025-54752

CVE-2025-54752 affects PowerCMS; vulnerable component is the handling of CSV files where malformed entries can cause embedded code execution when opened by a victim. Root cause cited: improper neutralization of formula elements in a CSV file. Impact described as code execution with user interacti...

CVE-2025-41396

PowerCMS (Alfasado PowerCMS) is affected by CVE-2025-41396 due to a path traversal vulnerability in the file-upload feature. The root cause allows a product user to overwrite arbitrary files on the system. Affected versions are multiple PowerCMS releases; impact is arbitrary file overwrite, with ...

CVE-2025-41391

CVE-2025-41391 is a stored cross-site scripting vulnerability in PowerCMS. The issue allows an arbitrary script to execute in a browser when a product user accesses a malicious page. Connected sources confirm PowerCMS (Alfasado Inc.) as affected and describe multiple PowerCMS pages/versions as im...