Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
11 vulnerabilities by alfasado
CVE-2025-36563 (GCVE-0-2025-36563)
Vulnerability from cvelistv5 – Published: 2025-07-31 07:25 – Updated: 2025-07-31 13:24
VLAI
Summary
Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed on the browser.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS |
Affected:
6.7 and earlier (PowerCMS 6.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
5.3 and earlier (PowerCMS 5.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
4.6 and earlier (PowerCMS 4.x series)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-36563",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T13:24:02.701345Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T13:24:12.574Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "6.7 and earlier (PowerCMS 6.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.3 and earlier (PowerCMS 5.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "4.6 and earlier (PowerCMS 4.x series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed on the browser."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T07:25:44.979Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.powercms.jp/news/release-powercms-671-531-461.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93412964/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-36563",
"datePublished": "2025-07-31T07:25:44.979Z",
"dateReserved": "2025-07-30T05:36:42.404Z",
"dateUpdated": "2025-07-31T13:24:12.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-41391 (GCVE-0-2025-41391)
Vulnerability from cvelistv5 – Published: 2025-07-31 07:25 – Updated: 2025-07-31 14:23
VLAI
Summary
Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS |
Affected:
6.7 and earlier (PowerCMS 6.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
5.3 and earlier (PowerCMS 5.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
4.6 and earlier (PowerCMS 4.x series)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T14:23:21.361216Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T14:23:47.388Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "6.7 and earlier (PowerCMS 6.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.3 and earlier (PowerCMS 5.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "4.6 and earlier (PowerCMS 4.x series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting (XSS)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T07:25:10.798Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.powercms.jp/news/release-powercms-671-531-461.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93412964/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-41391",
"datePublished": "2025-07-31T07:25:10.798Z",
"dateReserved": "2025-07-30T05:36:41.529Z",
"dateUpdated": "2025-07-31T14:23:47.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-41396 (GCVE-0-2025-41396)
Vulnerability from cvelistv5 – Published: 2025-07-31 07:24 – Updated: 2025-07-31 15:14
VLAI
Summary
A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper limitation of a pathname to a restricted directory ('Path Traversal')
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS |
Affected:
6.7 and earlier (PowerCMS 6.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
5.3 and earlier (PowerCMS 5.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
4.6 and earlier (PowerCMS 4.x series)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T15:08:24.252684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T15:14:06.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "6.7 and earlier (PowerCMS 6.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.3 and earlier (PowerCMS 5.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "4.6 and earlier (PowerCMS 4.x series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T07:24:20.561Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.powercms.jp/news/release-powercms-671-531-461.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93412964/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-41396",
"datePublished": "2025-07-31T07:24:20.561Z",
"dateReserved": "2025-07-30T05:36:38.599Z",
"dateUpdated": "2025-07-31T15:14:06.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-46359 (GCVE-0-2025-46359)
Vulnerability from cvelistv5 – Published: 2025-07-31 07:22 – Updated: 2025-07-31 15:28
VLAI
Summary
A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper limitation of a pathname to a restricted directory ('Path Traversal')
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS |
Affected:
6.7 and earlier (PowerCMS 6.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
5.3 and earlier (PowerCMS 5.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
4.6 and earlier (PowerCMS 4.x series)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-46359",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T15:24:33.388992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T15:28:30.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "6.7 and earlier (PowerCMS 6.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.3 and earlier (PowerCMS 5.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "4.6 and earlier (PowerCMS 4.x series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T07:22:46.914Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.powercms.jp/news/release-powercms-671-531-461.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93412964/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-46359",
"datePublished": "2025-07-31T07:22:46.914Z",
"dateReserved": "2025-07-30T05:36:45.484Z",
"dateUpdated": "2025-07-31T15:28:30.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-54752 (GCVE-0-2025-54752)
Vulnerability from cvelistv5 – Published: 2025-07-31 07:21 – Updated: 2025-07-31 15:44
VLAI
Summary
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1236 - Improper neutralization of formula elements in a CSV file
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS |
Affected:
6.7 and earlier (PowerCMS 6.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
5.3 and earlier (PowerCMS 5.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
4.6 and earlier (PowerCMS 4.x series)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54752",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T15:39:04.065052Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T15:44:45.539Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "6.7 and earlier (PowerCMS 6.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.3 and earlier (PowerCMS 5.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "4.6 and earlier (PowerCMS 4.x series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user\u0027s environment, the embedded code may be executed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper neutralization of formula elements in a CSV file",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T07:21:57.639Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.powercms.jp/news/release-powercms-671-531-461.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93412964/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-54752",
"datePublished": "2025-07-31T07:21:57.639Z",
"dateReserved": "2025-07-30T05:36:44.305Z",
"dateUpdated": "2025-07-31T15:44:45.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-54757 (GCVE-0-2025-54757)
Vulnerability from cvelistv5 – Published: 2025-07-31 07:20 – Updated: 2025-07-31 17:28
VLAI
Summary
Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted upload of file with dangerous type
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS |
Affected:
6.7 and earlier (PowerCMS 6.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
5.3 and earlier (PowerCMS 5.x series)
|
|
| Alfasado Inc. | PowerCMS |
Affected:
4.6 and earlier (PowerCMS 4.x series)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T17:27:47.515677Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T17:28:13.000Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "6.7 and earlier (PowerCMS 6.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.3 and earlier (PowerCMS 5.x series)"
}
]
},
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "4.6 and earlier (PowerCMS 4.x series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted upload of file with dangerous type",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T07:20:30.689Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.powercms.jp/news/release-powercms-671-531-461.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU93412964/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-54757",
"datePublished": "2025-07-31T07:20:30.689Z",
"dateReserved": "2025-07-30T05:36:43.437Z",
"dateUpdated": "2025-07-31T17:28:13.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-50297 (GCVE-0-2023-50297)
Vulnerability from cvelistv5 – Published: 2023-12-26 05:53 – Updated: 2024-11-27 15:22
VLAI
Summary
Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Open Redirect
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS (PowerCMS 6 Series) |
Affected:
6.31 and earlier
|
|
| Alfasado Inc. | PowerCMS (PowerCMS 5 Series) |
Affected:
5.24 and earlier
|
|
| Alfasado Inc. | PowerCMS (PowerCMS 4 Series) |
Affected:
4.54 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:16:46.096Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.powercms.jp/news/release-powercms-202312.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN32646742/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-50297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-11T18:54:45.569296Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T15:22:46.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS (PowerCMS 6 Series)",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "6.31 and earlier"
}
]
},
{
"product": "PowerCMS (PowerCMS 5 Series)",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.24 and earlier"
}
]
},
{
"product": "PowerCMS (PowerCMS 4 Series)",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "4.54 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Open Redirect",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-26T05:53:48.253Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.powercms.jp/news/release-powercms-202312.html"
},
{
"url": "https://jvn.jp/en/jp/JVN32646742/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-50297",
"datePublished": "2023-12-26T05:53:48.253Z",
"dateReserved": "2023-12-21T12:24:05.573Z",
"dateUpdated": "2024-11-27T15:22:46.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-49117 (GCVE-0-2023-49117)
Vulnerability from cvelistv5 – Published: 2023-12-26 05:53 – Updated: 2024-08-02 21:46
VLAI
Summary
PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
Severity
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
2 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS (PowerCMS 6 Series) |
Affected:
6.31 and earlier
|
|
| Alfasado Inc. | PowerCMS (PowerCMS 5 Series) |
Affected:
5.24 and earlier
|
|
| Alfasado Inc. | PowerCMS (PowerCMS 4 Series) |
Affected:
4.54 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:46:29.150Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.powercms.jp/news/release-powercms-202312.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN32646742/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS (PowerCMS 6 Series)",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "6.31 and earlier"
}
]
},
{
"product": "PowerCMS (PowerCMS 5 Series)",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.24 and earlier"
}
]
},
{
"product": "PowerCMS (PowerCMS 4 Series)",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "4.54 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user\u0027s web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-26T05:53:40.513Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.powercms.jp/news/release-powercms-202312.html"
},
{
"url": "https://jvn.jp/en/jp/JVN32646742/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-49117",
"datePublished": "2023-12-26T05:53:40.513Z",
"dateReserved": "2023-12-21T12:24:04.679Z",
"dateUpdated": "2024-08-02T21:46:29.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-33941 (GCVE-0-2022-33941)
Vulnerability from cvelistv5 – Published: 2022-09-08 07:10 – Updated: 2024-08-03 08:16
VLAI
Summary
PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.
Severity
No CVSS data available.
CWE
- OS Command Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.powercms.jp/news/xmlrpc-api-provision… | x_refsource_MISC |
| https://jvn.jp/en/jp/JVN76024879/index.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS XMLRPC API |
Affected:
PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T08:16:15.908Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN76024879/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS XMLRPC API",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS Command Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-08T07:10:41.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/en/jp/JVN76024879/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2022-33941",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PowerCMS XMLRPC API",
"version": {
"version_data": [
{
"version_value": "PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)"
}
]
}
}
]
},
"vendor_name": "Alfasado Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html",
"refsource": "MISC",
"url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
},
{
"name": "https://jvn.jp/en/jp/JVN76024879/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/en/jp/JVN76024879/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2022-33941",
"datePublished": "2022-09-08T07:10:41.000Z",
"dateReserved": "2022-08-30T00:00:00.000Z",
"dateUpdated": "2024-08-03T08:16:15.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-20850 (GCVE-0-2021-20850)
Vulnerability from cvelistv5 – Published: 2021-11-24 08:25 – Updated: 2024-08-03 17:53
VLAI
Summary
PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remote attacker to execute an arbitrary OS command via unspecified vectors.
Severity
No CVSS data available.
CWE
- OS Command Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.powercms.jp/news/release-patch-xmlrpc… | x_refsource_MISC |
| https://jvn.jp/en/jp/JVN17645965/index.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS XMLRPC API |
Affected:
PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, PowerCMS 2 Series (End-of-Life, EOL)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:53:22.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.powercms.jp/news/release-patch-xmlrpc-api-202110.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN17645965/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS XMLRPC API",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, PowerCMS 2 Series (End-of-Life, EOL)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remote attacker to execute an arbitrary OS command via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS Command Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-24T08:25:51.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.powercms.jp/news/release-patch-xmlrpc-api-202110.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/en/jp/JVN17645965/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2021-20850",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PowerCMS XMLRPC API",
"version": {
"version_data": [
{
"version_value": "PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, PowerCMS 2 Series (End-of-Life, EOL)"
}
]
}
}
]
},
"vendor_name": "Alfasado Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, EOL) allows a remote attacker to execute an arbitrary OS command via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.powercms.jp/news/release-patch-xmlrpc-api-202110.html",
"refsource": "MISC",
"url": "https://www.powercms.jp/news/release-patch-xmlrpc-api-202110.html"
},
{
"name": "https://jvn.jp/en/jp/JVN17645965/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/en/jp/JVN17645965/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2021-20850",
"datePublished": "2021-11-24T08:25:51.000Z",
"dateReserved": "2020-12-17T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:53:22.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-6020 (GCVE-0-2019-6020)
Vulnerability from cvelistv5 – Published: 2019-12-26 15:16 – Updated: 2024-08-04 20:16
VLAI
Summary
Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
Severity
No CVSS data available.
CWE
- Open Redirect
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.powercms.jp/news/release-powercms-201… | x_refsource_MISC |
| http://jvn.jp/en/jp/JVN34634458/index.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Alfasado Inc. | PowerCMS |
Affected:
5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:16:23.965Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.powercms.jp/news/release-powercms-201910.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN34634458/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PowerCMS",
"vendor": "Alfasado Inc.",
"versions": [
{
"status": "affected",
"version": "5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Open Redirect",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-26T15:16:50.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.powercms.jp/news/release-powercms-201910.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://jvn.jp/en/jp/JVN34634458/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2019-6020",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PowerCMS",
"version": {
"version_data": [
{
"version_value": "5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x)"
}
]
}
}
]
},
"vendor_name": "Alfasado Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Open Redirect"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.powercms.jp/news/release-powercms-201910.html",
"refsource": "MISC",
"url": "https://www.powercms.jp/news/release-powercms-201910.html"
},
{
"name": "http://jvn.jp/en/jp/JVN34634458/index.html",
"refsource": "MISC",
"url": "http://jvn.jp/en/jp/JVN34634458/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2019-6020",
"datePublished": "2019-12-26T15:16:50.000Z",
"dateReserved": "2019-01-10T00:00:00.000Z",
"dateUpdated": "2024-08-04T20:16:23.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}