CVE-2025-29993CWE-74

The affected versions of PowerCMS allow HTTP header injection

Medium · published March 27, 2025

CVSS v3.0
5.3
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2025-03-27T09:06Z
EPSS history
Timeline
  • 27 MAR 09:06Z
    The affected versions of PowerCMS allow HTTP header injection
    cvelistv5