2025

Unauthenticated attackers can query an API endpoint and get device details.

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.

Unauthenticated attackers can rename "rooms" of arbitrary users.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT B

Improper Control of Generation of Code ('Code Injection') vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets a

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in covertnine C9 Bloc

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in graphthemes Glossy

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Home S

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainá tai

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Del

Cross-Site Request Forgery (CSRF) vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Fo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT S

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngi

Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Addition

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware Spa

An unauthenticated attacker can hijack other users' devices and potentially control them.

An attacker can export other users' plant information.

Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC R

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncann

An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential D

An authenticated attacker can obtain any plant name by knowing the plant ID.

An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.

An unauthenticated attacker can check the existence of usernames in the system by querying an API.

An unauthenticated attacker can obtain a user's plant list by knowing the username.

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte

Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion (component: Core Smart View). The support

Vulnerability in the RDBMS Listener component of Oracle Database Server. Supported versions that are affected are 19.3-

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported

Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (c

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version th

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affecte

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). Supported versions tha

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version th

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Uplo

Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Diagnostics Scripts). Su

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that ar

Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job O

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Uplo

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). Supported versions

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions