powercms vulnerabilities and fixes

Recent CVEs affecting powercms, with upgrade or downgrade steps. 6 tracked.

powercms has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-07-31. Highest priority: CVE-2025-46359 (score 38/100).

• CVE-2025-54757 MEDIUM 6.5 UPGRADE Multiple versions of PowerCMS allow unrestricted upload of dangerous files
• CVE-2025-54752 MEDIUM 6.5 UPGRADE Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file
• CVE-2025-46359 HIGH 7.2 UPGRADE A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS
• CVE-2025-41396 MEDIUM 5.4 UPGRADE A path traversal issue exists in file uploading feature of multiple versions of PowerCMS
• CVE-2025-41391 MEDIUM 5.4 UPGRADE Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS
• CVE-2025-36563 MEDIUM 6.1 UPGRADE Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS

FAQ

How do I fix powercms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is powercms being exploited right now?

None of the tracked powercms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which powercms CVE should I patch first?

CVE-2025-46359 currently ranks highest (38/100): A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS.

RSS feed for powercms · ← Back to latest CVEs