CVE-2025-54752 | THREATINT

Description

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.

Reserved 2025-07-30 | Published 2025-07-31 | Updated 2025-07-31 | Assigner jpcert

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Problem types

Improper neutralization of formula elements in a CSV file

Product status

6.7 and earlier (PowerCMS 6.x series)

affected

5.3 and earlier (PowerCMS 5.x series)

affected

4.6 and earlier (PowerCMS 4.x series)

affected

References

www.powercms.jp/news/release-powercms-671-531-461.html

jvn.jp/en/vu/JVNVU93412964/

cve.org (CVE-2025-54752)

nvd.nist.gov (CVE-2025-54752)

Download JSON