Microsoft Power Pages
Monthly
Remote code execution in Microsoft Power Pages allows an unauthorized network attacker to inject and execute arbitrary operating-system commands via improperly neutralized special elements (CWE-77). Because Power Pages is a Microsoft-hosted, low-code website-building SaaS platform, the flaw affects the service surface Microsoft exposes to tenants, and a successful attack yields full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), but the CVSS 9.8 rating and 'total' technical impact make it a high-severity issue.
Remote code execution in Microsoft Power Pages allows an unauthorized network attacker to inject and execute arbitrary operating-system commands via improperly neutralized special elements (CWE-77). Because Power Pages is a Microsoft-hosted, low-code website-building SaaS platform, the flaw affects the service surface Microsoft exposes to tenants, and a successful attack yields full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), but the CVSS 9.8 rating and 'total' technical impact make it a high-severity issue.