medium6.5
CVE-2025-54752
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file.
Impact
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alfasado | Powercms | from 4.0 before 4.61 from 5.0 before 5.31 from 6.0 before 6.71 |