Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: Alfasado Inc. Component: Powercms Clear all filters
TI-2025-24878 CVE-2025-36563 · GHSA-hrw8-p8vq-hx3r

Cross-site scripting in Alfasado Inc. PowerCMS

Priority LOW 23

Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00217 Published 2025-07-31 No fix listed CWE-79
TI-2025-27569 CVE-2025-41391 · GHSA-273r-f986-fq9q

Cross-site scripting in Alfasado Inc. PowerCMS

Priority LOW 23

Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00203 Published 2025-07-31 No fix listed CWE-79
TI-2025-27573 CVE-2025-41396 · GHSA-q6h2-xf45-gv93

Path traversal in Alfasado Inc. PowerCMS

Priority LOW 24

A path traversal issue exists in file uploading feature of multiple versions of PowerCMS.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00432 Published 2025-07-31 No fix listed CWE-22
TI-2025-29096 CVE-2025-46359 · GHSA-rvp7-mgh9-qv55

Path traversal in Alfasado Inc. PowerCMS

Priority MEDIUM 40

A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00676 Published 2025-07-31 No fix listed CWE-22
TI-2025-34515 CVE-2025-54752 · GHSA-fx25-qh4f-8ghh

CSV injection in Alfasado Inc. PowerCMS

Priority LOW 22

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00281 Published 2025-07-31 No fix listed CWE-1236
TI-2025-34519 CVE-2025-54757 · GHSA-whwv-236h-fxh5

Unrestricted file upload in Alfasado Inc. PowerCMS

Priority LOW 23

Multiple versions of PowerCMS allow unrestricted upload of dangerous files.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00247 Published 2025-07-31 No fix listed CWE-434
TI-2023-27506 CVE-2023-50297 · GHSA-2pp8-cqff-m6w4

Open redirect in Alfasado Inc. PowerCMS

Priority LOW 27

Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00402 Published 2023-12-26 No fix listed CWE-601
TI-2023-26781 CVE-2023-49117 · GHSA-wxvg-wr3r-wmm7

Cross-site scripting in Alfasado Inc. PowerCMS

Priority LOW 24

PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00298 Published 2023-12-26 No fix listed CWE-79
TI-2021-04064 CVE-2021-20850 · GHSA-cw2g-2q23-x8ff

OS command injection in Alfasado Inc. PowerCMS XMLRPC API

Priority MEDIUM 45

PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remote attacker to execute an arbitrary OS command via unspecifie…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01535 Published 2021-11-24 No fix listed CWE-78
TI-2019-04309 CVE-2019-6020 · GHSA-w2c2-h6w5-j5pf

Open redirect in Alfasado Inc. PowerCMS

Priority LOW 29

Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attackers to redirect users to arbitrary web sites and conduct…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00851 Published 2019-12-26 No fix listed CWE-601