Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Jul 31, 2025Multiple versions of PowerCMS allow unrestricted upload of dangerous files.CVE-2025-54757 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 5.1
Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser.
- Product
- PowerCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file.CVE-2025-54752 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
- Product
- PowerCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS.CVE-2025-46359 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpHigh 8.6
A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.
- Product
- PowerCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A path traversal issue exists in file uploading feature of multiple versions of PowerCMS.CVE-2025-41396 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 5.3
A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user.
- Product
- PowerCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS.CVE-2025-41391 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 5.1
Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser.
- Product
- PowerCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS.CVE-2025-36563 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 5.3
Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed on the browser.
- Product
- PowerCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025The affected versions of PowerCMS allow HTTP header injection.CVE-2025-29993 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 5.3
The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail.
- Product
- PowerCMS 6.x series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites viaCVE-2023-50297 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
- Product
- PowerCMS (PowerCMS 6 Series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability.CVE-2023-49117 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 5.4
PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
- Product
- PowerCMS (PowerCMS 6 Series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022PowerCMS XMLRPC API provided by Alfasado Inc.CVE-2022-33941 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpCritical 9.8
PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
- Product
- PowerCMS XMLRPC API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2021PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remotCVE-2021-20850 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpCritical 9.8
PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remote attacker to execute an arbitrary OS command via unspecified vectors.
- Product
- PowerCMS XMLRPC API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2019Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attCVE-2019-6020 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
- Product
- PowerCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.