CVE-2025-29993 Other in PowerCMS 4.x series
Attackers can inject HTTP headers to manipulate email URLs, potentially redirecting password reset links in PowerCMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-29993?
CVE-2025-29993 is a medium-severity vulnerability in Alfasado Inc. PowerCMS 4.x series, published on 27 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail.
Weakness: CWE-74
Which versions are affected by CVE-2025-29993?
How do I fix CVE-2025-29993?
No fix has been published for CVE-2025-29993 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-29993 being exploited?
There is no known exploitation of CVE-2025-29993 in the wild and no public exploit code.
Sources
Also known as GHSA-fxjm-4m3m-24xv.