CVE-2022-33941

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.

• CWE-78

• https://jvn.jp/en/jp/JVN76024879/index.htmlThird Party Advisory
• https://www.powercms.jp/news/xmlrpc-api-provision-202208.htmlPatch, Vendor Advisory
• https://jvn.jp/en/jp/JVN76024879/index.htmlThird Party Advisory
• https://www.powercms.jp/news/xmlrpc-api-provision-202208.htmlPatch, Vendor Advisory

Published

Sep 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-33936Cloud Mobility for Dell EMC Storage, 1.3.0.XXX contains a RC…9.8
• CVE-2022-33937Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal …7.1
• CVE-2022-33938A format string injection vulnerability exists in the ghome_…9.8
• CVE-2022-33939CENTUM VP / CS 3000 controller FCS (CP31, CP33, CP345, CP401…7.5
• CVE-2022-3394The WP All Export Pro WordPress plugin before 1.7.9 does not…7.2
• CVE-2022-33940Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-33942Protection mechanism failure in the Intel(R) DCM software be…8.8
• CVE-2022-33943Authenticated (contributor or higher user role) Cross-Site S…5.4
• CVE-2022-33944The main MiCODUS MV720 GPS tracker web server has an authent…6.5
• CVE-2022-33945Improper input validation in some Intel(R) Server board and …6.7
• CVE-2022-33946Improper authentication in the Intel(R) SUR software before …7.8
• CVE-2022-33947In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.…6.5