CVE-2025-41396

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
Alfasado Inc.PowerCMS6.7 and earlier (PowerCMS 6.x series)
Alfasado Inc.PowerCMS5.3 and earlier (PowerCMS 5.x series)
Alfasado Inc.PowerCMS4.6 and earlier (PowerCMS 4.x series)

References

Timeline

Published
Jul 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-413997.5When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in CVE-2025-41409.8A vulnerability, which was classified as critical, has been found in Netgear EX6120 1.0.3.94. Affected by this issue is the function sub_303CVE-2025-414025.5Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competeCVE-2025-414038.3Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audiCVE-2025-414045.3Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-publicCVE-2025-414066.1Cross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specificCVE-2025-414078.3Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.CVE-2025-414085.3Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remoteCVE-2025-41419.8A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. This affects the function sub_3C03C. The manipulatiCVE-2025-414105.4Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process wCVE-2025-414137.8Fuji Electric Smart Editor is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.CVE-2025-414147.5When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Softwa
CVE-2025-41396: Medium severity, CVSS 6.5 | Vulnix