CVE-2025-46359

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
Alfasado Inc.PowerCMS6.7 and earlier (PowerCMS 6.x series)
Alfasado Inc.PowerCMS5.3 and earlier (PowerCMS 5.x series)
Alfasado Inc.PowerCMS4.6 and earlier (PowerCMS 4.x series)

References

Timeline

Published
Jul 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-46367.8Due to excessive privileges granted to the web user running the airpointer web platform, a malicious actor that gains control of the this usCVE-2025-463625.5Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. A low privileged atCVE-2025-463634.3Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerCVE-2025-463647.2Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape VulnerabilitCVE-2025-463656.7Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to causeCVE-2025-463666.7Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation CVE-2025-463677.8Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. CVE-2025-463685.5Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aCVE-2025-463697.8Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aCVE-2025-46377.5Divide By Zero vulnerability in davisking dlib allows remote attackers to cause a denial of service via a crafted file. .This issue affecCVE-2025-463705.5Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability. A low privileged attacker wiCVE-2025-463715.5Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low pr
CVE-2025-46359: High severity, CVSS 7.2 | Vulnix