CVE-2025-54752CWE-1236

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file

Medium · published July 31, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
EPSS
0.00261 · 16.9th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2025-07-31T07:21Z
EPSS history
Timeline
  • 31 JUL 07:21Z
    Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file
    cvelistv5