Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2025-54752

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and op

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jpcert

Description

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Alfasado Inc. PowerCMS

  • 6.7 and earlier (PowerCMS 6.x series)affected

Alfasado Inc. PowerCMS

  • 5.3 and earlier (PowerCMS 5.x series)affected

Alfasado Inc. PowerCMS

  • 4.6 and earlier (PowerCMS 4.x series)affected

References