CVE-2025-36563: Alfasado PowerCMS XSS Vulnerability

CVE-2025-36563 Overview

CVE-2025-36563 is a reflected cross-site scripting (XSS) vulnerability affecting multiple versions of PowerCMS, a Japanese content management system developed by Alfasado. An attacker can craft a malicious URL that, when accessed by an authenticated PowerCMS administrator, executes arbitrary JavaScript in the administrator's browser session. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation requires user interaction, specifically an administrator clicking a crafted link. The issue is tracked by JPCERT/CC through the JVN Security Advisory and addressed in PowerCMS releases 6.71, 5.31, and 4.61.

Critical Impact
Attackers can execute arbitrary JavaScript in an administrator's browser context, enabling session theft, administrative action forgery, and potential lateral compromise of PowerCMS-managed content.

Affected Products

Alfasado PowerCMS versions prior to 6.71
Alfasado PowerCMS versions prior to 5.31
Alfasado PowerCMS versions prior to 4.61

Discovery Timeline

2025-07-31 - CVE-2025-36563 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36563

Vulnerability Analysis

CVE-2025-36563 is a reflected XSS vulnerability. The PowerCMS application reflects attacker-controlled input from a crafted URL back into the HTML response without adequate output encoding or input sanitization. When a PowerCMS administrator opens the malicious URL, the browser parses the injected payload as executable script within the trusted PowerCMS origin.

Because the payload runs with the administrator's authenticated session, an attacker can perform any action the administrator can perform. This includes reading and modifying content, altering site configuration, creating new administrator accounts, or exfiltrating session cookies to hijack the account.

The EPSS score is 0.19%, indicating low observed exploitation likelihood. However, targeted phishing against known PowerCMS administrators remains a practical delivery method.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. One or more request parameters processed by PowerCMS are echoed into the rendered HTML without contextual output encoding. This allows HTML and JavaScript metacharacters supplied in the URL to break out of their intended data context and execute as script.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL containing a malicious script payload targeting a vulnerable PowerCMS parameter. The attacker then delivers the URL to a PowerCMS administrator through phishing email, chat, or an untrusted referrer.

When the administrator clicks the link while authenticated to PowerCMS, the injected script executes in the browser. The script can then invoke authenticated PowerCMS APIs, read the DOM, or exfiltrate cookies and CSRF tokens to attacker-controlled infrastructure. See the JVN Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-36563

Indicators of Compromise

HTTP access logs containing PowerCMS request parameters with encoded script fragments such as %3Cscript, onerror=, onload=, or javascript:.
Unusual Referer headers on administrator sessions pointing to external phishing domains.
Unexpected outbound requests from administrator browsers to unknown domains shortly after loading a PowerCMS admin URL.
Creation of new administrator accounts or unexpected content changes correlated with administrator sessions.

Detection Strategies

Inspect web server and reverse proxy logs for PowerCMS query strings containing HTML tag characters or JavaScript event handler keywords.
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS signatures against PowerCMS request paths.
Correlate administrator authentication events with anomalous outbound network activity from the same host using endpoint and SIEM telemetry.
Review PowerCMS audit logs for administrative actions that lack a corresponding legitimate user workflow.

Monitoring Recommendations

Alert on PowerCMS administrator sessions that originate from atypical IP addresses or geolocations.
Monitor for browser process behavior indicating credential or cookie exfiltration on administrator workstations.
Track patch state of PowerCMS instances against fixed versions 6.71, 5.31, and 4.61.

How to Mitigate CVE-2025-36563

Immediate Actions Required

Upgrade PowerCMS to version 6.71, 5.31, or 4.61 depending on the deployed release branch.
Notify all PowerCMS administrators to avoid clicking untrusted links to the PowerCMS admin interface until patching is complete.
Rotate administrator session cookies and passwords if suspicious activity is observed.
Review recent administrative changes and audit logs for signs of unauthorized modification.

Patch Information

Alfasado has released fixed versions in the PowerCMS Release Notes. Administrators should apply PowerCMS 6.71, 5.31, or 4.61 based on their supported branch. Additional vendor guidance is available in the JVN Security Advisory.

Workarounds

Restrict access to the PowerCMS administration interface by IP allow-list at the network or reverse proxy layer.
Deploy a WAF rule to block requests containing script tags or event handler attributes in PowerCMS query parameters.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on PowerCMS admin pages to reduce reflected XSS impact.
Require administrators to use dedicated browser profiles or sessions when accessing PowerCMS to limit cross-site payload delivery.

bash

# Example nginx rule to block obvious reflected XSS payloads on PowerCMS endpoints
location /powercms/ {
    if ($args ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://powercms_backend;
}