« Volver al listado

CVE-2025-29993

Estado: AplazadaMedia (5.3)—

The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Alfasado — PowercmsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-29993",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-29993",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-27T13:30:01.130372Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Alfasado Inc.",
          "product": "PowerCMS 6.x series",
          "versions": [
            {
              "status": "affected",
              "version": "6.6 and earlier"
            }
          ]
        },
        {
          "vendor": "Alfasado Inc.",
          "product": "PowerCMS 5.x series",
          "versions": [
            {
              "status": "affected",
              "version": "5.27 and earlier"
            }
          ]
        },
        {
          "vendor": "Alfasado Inc.",
          "product": "PowerCMS 4.x series",
          "versions": [
            {
              "status": "affected",
              "version": "4.58 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-27T10:15:14.063",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN39026557/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.powercms.jp/news/release-powercms-661-528-459.html",
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vultures@jpcert.or.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail."
    },
    {
      "lang": "es",
      "value": "Las versiones afectadas de PowerCMS permiten la inyección de encabezados HTTP. Esta vulnerabilidad puede aprovecharse para que el producto afectado envíe correos electrónicos con una URL alterada, como un correo de restablecimiento de contraseña."
    }
  ],
  "lastModified": "2026-06-17T09:06:02.673",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}