https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-54757.htmlhttps://patchthecve.com/cve/CVE-2025-54757.htmlWed, 17 Jun 2026 09:40:39 +0000MEDIUM 6.5: Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser.https://patchthecve.com/cve/CVE-2025-54752.htmlhttps://patchthecve.com/cve/CVE-2025-54752.htmlWed, 17 Jun 2026 09:40:38 +0000MEDIUM 6.5: Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.https://patchthecve.com/cve/CVE-2025-46359.htmlhttps://patchthecve.com/cve/CVE-2025-46359.htmlWed, 17 Jun 2026 09:26:17 +0000HIGH 7.2: A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.https://patchthecve.com/cve/CVE-2025-41396.htmlhttps://patchthecve.com/cve/CVE-2025-41396.htmlWed, 17 Jun 2026 09:22:49 +0000MEDIUM 5.4: A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user.https://patchthecve.com/cve/CVE-2025-41391.htmlhttps://patchthecve.com/cve/CVE-2025-41391.htmlWed, 17 Jun 2026 09:22:48 +0000MEDIUM 5.4: Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser.https://patchthecve.com/cve/CVE-2025-36563.htmlhttps://patchthecve.com/cve/CVE-2025-36563.htmlWed, 17 Jun 2026 09:14:47 +0000MEDIUM 6.1: Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed on the browser.https://patchthecve.com/cve/CVE-2023-50297.htmlhttps://patchthecve.com/cve/CVE-2023-50297.htmlWed, 17 Jun 2026 06:39:26 +0000MEDIUM 6.1: Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affectedhttps://patchthecve.com/cve/CVE-2023-49117.htmlhttps://patchthecve.com/cve/CVE-2023-49117.htmlWed, 17 Jun 2026 06:35:24 +0000MEDIUM 5.4: PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL