CVE-2025-41391 - Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS · CoreCVE

Back Back to CVE browser

MEDIUM

Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS

Published Jul 31, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.18%

Description

Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser.

Affected products

Vendor Alfasado Inc. Product PowerCMS Default
n/a
- Version
  4.6 and earlier (PowerCMS 4.x series)
  Status
  affected
  Constraints
  -
- Version
  5.3 and earlier (PowerCMS 5.x series)
  Status
  affected
  Constraints
  -
- Version
  6.7 and earlier (PowerCMS 6.x series)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
4.6 and earlier (PowerCMS 4.x series)	affected	-
5.3 and earlier (PowerCMS 5.x series)	affected	-
6.7 and earlier (PowerCMS 6.x series)	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://jvn.jp/en/vu/JVNVU93412964/
Third Party Advisory
https://www.powercms.jp/news/release-powercms-671-531-461.html
Vendor Advisory

Link	Providers	Tags
https://jvn.jp/en/vu/JVNVU93412964/		Third Party Advisory
https://www.powercms.jp/news/release-powercms-671-531-461.html		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner jpcert

Published Jul 31, 2025

Updated Jul 31, 2025

Reserved Jul 30, 2025

Link CVE-2025-41391

CISA Vulnrichment

Updated Jul 31, 2025

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-41391

Severity n/a

Public date n/a

Links CVE-2025-41391