Alfasado vulnerabilities
We track 4 vulnerabilities in Alfasado products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 31, 2025.
Latest Alfasado vulnerabilities
- 8.0 High severity
PowerCMS: Unrestricted Upload of File with Dangerous Type
Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser.
- 8.0 High severity
PowerCMS: Improper Neutralization of Formula Elements in a CSV File
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
- 7.2 High severity
PowerCMS: Improper Limitation of a Pathname to a Restricted Directory
A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.
- 9.8 Critical severity
PowerCMS XMLRPC API: Improper Neutralization of Special Elements used in an OS Command
PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through i