JVN#39026557
Multiple vulnerabilities in PowerCMS

Overview

PowerCMS provided by Alfasado Inc. contains multiple vulnerabilities.

Products Affected

• PowerCMS 6.6 and earlier (PowerCMS 6.x series)
• PowerCMS 5.27 and earlier (PowerCMS 5.x series)
• PowerCMS 4.58 and earlier (PowerCMS 4.x series)

Description

PowerCMS provided by Alfasado Inc. contains multiple vulnerabilities listed below.

• Injection (CWE-74)
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score 5.3
  • CVE-2025-29993
  • The product improperly processes HTTP headers.
• Dependency on vulnerable third-party component (CWE-1395)
  • jQuery Validation plugin used in the product is vulnerable to ReDoS vulnerability (CVE-2021-21252)

Impact

• The affected product may be directed to send email to a user, such as password reset mail, with a tampered URL (CVE-2025-29993)
• The vulnerability (CVE-2021-21252) in jQuery Validation plugin used in the product may be exploited to cause a denial-of-service (DoS) condition

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.