CVE-2025-41391: Alfasado PowerCMS XSS Vulnerability

CVE-2025-41391 Overview

CVE-2025-41391 is a stored cross-site scripting (XSS) vulnerability affecting multiple versions of Alfasado PowerCMS. An authenticated attacker can inject malicious script content that persists in the application. When another user views the affected page, the browser executes the attacker-controlled script in the context of that user's session.

The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Exploitation requires low privileges and user interaction. The vulnerability affects confidentiality and integrity of downstream browser sessions rather than the PowerCMS server itself.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the browsers of PowerCMS users, potentially enabling session theft, credential harvesting, or unauthorized actions performed as the victim.

Affected Products

• Alfasado PowerCMS versions prior to 6.7.1
• Alfasado PowerCMS versions prior to 5.3.1
• Alfasado PowerCMS versions prior to 4.6.1

Discovery Timeline

• 2025-07-31 - CVE-2025-41391 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41391

Vulnerability Analysis

The vulnerability is a stored XSS issue in PowerCMS, a Japanese enterprise content management system developed by Alfasado. Stored XSS occurs when user-supplied input is persisted by the application and later rendered to other users without proper output encoding or sanitization.

In this case, an attacker with access to a PowerCMS input field can submit crafted payloads containing HTML or JavaScript. PowerCMS stores the input and returns it to other users when they access the affected page. The victim's browser then interprets the payload as executable script.

The attack targets product users, meaning administrators, editors, or other authenticated users of the CMS. Successful exploitation runs in the security context of the victim's authenticated session with the CMS.

Root Cause

The root cause is insufficient output encoding or input sanitization of user-supplied content before it is rendered in HTML responses. PowerCMS fails to neutralize special characters such as <, >, and quotation marks in one or more fields, allowing script tags and event handlers to survive into rendered output.

Attack Vector

Exploitation follows a two-stage pattern. First, an authenticated attacker submits a payload through a vulnerable PowerCMS input field. Second, when a legitimate user accesses the page containing the stored payload, the malicious script executes in their browser.

The attacker requires low privileges to inject the payload but relies on user interaction from the victim to trigger execution. Impact is bounded to the browser session, but session token theft or forced administrative actions are realistic follow-on outcomes.

No public proof-of-concept exploit is available. Refer to the JVN Vulnerability Information advisory for additional technical context.

Detection Methods for CVE-2025-41391

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or HTML event handlers such as onerror and onload stored in PowerCMS content fields or database tables.
• Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading PowerCMS pages, suggesting exfiltration by injected scripts.
• PowerCMS audit logs showing content edits from unexpected user accounts or IP addresses.

Detection Strategies

• Scan PowerCMS database content and templates for HTML tags and JavaScript keywords in fields that should contain plain text.
• Inspect web server access logs for POST requests containing script-like payloads targeting PowerCMS admin endpoints.
• Correlate authentication events with content modification events to identify anomalous editing behavior.

Monitoring Recommendations

• Enable and review PowerCMS administrative activity logs on a continuous basis, focusing on content and template changes.
• Deploy a web application firewall (WAF) with XSS rule sets in front of PowerCMS to identify inbound injection attempts.
• Monitor Content Security Policy (CSP) violation reports if CSP is configured, since blocked script executions indicate attempted exploitation.

How to Mitigate CVE-2025-41391

Immediate Actions Required

• Upgrade PowerCMS to version 6.7.1, 5.3.1, or 4.6.1 depending on the deployed branch, as published in the PowerCMS Release Notes.
• Audit existing PowerCMS content and templates for previously injected payloads and remove any suspicious HTML or script content.
• Rotate credentials and invalidate active sessions for administrative users who may have viewed injected content.

Patch Information

Alfasado has released fixed versions of PowerCMS that address CVE-2025-41391. Administrators should apply version 6.7.1, 5.3.1, or 4.6.1 from the vendor's official release page. Verify the installed version through the PowerCMS administrative console after upgrade.

Workarounds

• Restrict PowerCMS administrative access to trusted networks using IP allow lists or VPN-based access control until patching is complete.
• Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce XSS impact.
• Reduce the number of accounts with content-editing privileges to limit the attack surface for injection.

# Configuration example: sample CSP header to reduce stored XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";