alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2025-41692 (published 2025-12-09)
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-916
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41693 (published 2025-12-09)
A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a reduced performance of the management functions. Switching functionality is not affected.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-770
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41694 (published 2025-12-09)
A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41695 (published 2025-12-09)
An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41696 (published 2025-12-09)
An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41697 (published 2025-12-09)
An attacker can use an undocumented UART port on the PCB as a side-channel    to get root access e.g. with the credentials obtained from CVE-2025-41692.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1299
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41698 (published 2025-08-05)
A low privileged local attacker can interact with the affected service although user-interaction should not be allowed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
CVE-2025-41699 (published 2025-10-14)
An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code ('Code Injection').
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
CVE-2025-41700 (published 2025-12-01)
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: codesys
Affected products: codesys
CVE-2025-41701 (published 2025-09-09)
An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-502
CVE-2025-41702 (published 2025-08-26)
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-321
CVE-2025-41703 (published 2025-10-14)
An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-306
CVE-2025-41704 (published 2025-10-14)
An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-770
CVE-2025-41705 (published 2025-10-14)
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Weakness: CWE-523
CVE-2025-41706 (published 2025-10-14)
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-120
CVE-2025-41707 (published 2025-10-14)
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-120
CVE-2025-41708 (published 2025-09-08)
Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-319
CVE-2025-41709 (published 2026-03-10)
An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
CVE-2025-41710 (published 2026-03-10)
An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-798
CVE-2025-41711 (published 2026-03-10)
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-327
CVE-2025-41712 (published 2026-03-10)
An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-732
CVE-2025-41713 (published 2025-09-15)
During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Weakness: CWE-1188
CVE-2025-41714 (published 2025-09-10)
The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
CVE-2025-41715 (published 2025-09-24)
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
CVE-2025-41716 (published 2025-09-24)
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-306
CVE-2025-41717 (published 2026-01-13)
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-94
CVE-2025-41718 (published 2025-10-14)
A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-319
CVE-2025-41719 (published 2025-10-22)
A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1286
CVE-2025-41720 (published 2025-10-22)
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-646
CVE-2025-41721 (published 2025-10-22)
A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected self-signed certificate.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-77
CVE-2025-41722 (published 2025-10-22)
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
CVE-2025-41723 (published 2025-10-22)
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-35
CVE-2025-41724 (published 2025-10-22)
An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-239
CVE-2025-41726 (published 2026-01-27)
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
CVE-2025-41727 (published 2026-01-27)
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-420
CVE-2025-41728 (published 2026-01-27)
A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager web service that cause an out-of-bounds read operation under certain circumstances due to ASLR and thereby potentially copy confidential information into a response.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
CVE-2025-41729 (published 2025-11-24)
An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-1287
CVE-2025-41730 (published 2025-12-10)
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: wago
Affected products: 0852-1322, 0852-1322_firmware, 0852-1328, 0852-1328_firmware
CVE-2025-41731 (published 2025-11-10)
A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-338
CVE-2025-41732 (published 2025-12-10)
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: wago
Affected products: 0852-1322, 0852-1322_firmware, 0852-1328, 0852-1328_firmware
CVE-2025-41733 (published 2025-11-18)
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-305
Affected vendors: metz-connect
Affected products: ewio2-bm, ewio2-bm_firmware, ewio2-m, ewio2-m-bm, ewio2-m-bm_firmware, ewio2-m_firmware
CVE-2025-41734 (published 2025-11-18)
An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-98
Affected vendors: metz-connect
Affected products: ewio2-bm, ewio2-bm_firmware, ewio2-m, ewio2-m-bm, ewio2-m-bm_firmware, ewio2-m_firmware
CVE-2025-41735 (published 2025-11-18)
A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: metz-connect
Affected products: ewio2-bm, ewio2-bm_firmware, ewio2-m, ewio2-m-bm, ewio2-m-bm_firmware, ewio2-m_firmware
CVE-2025-41736 (published 2025-11-18)
A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-35
Affected vendors: metz-connect
Affected products: ewio2-bm, ewio2-bm_firmware, ewio2-m, ewio2-m-bm, ewio2-m-bm_firmware, ewio2-m_firmware
CVE-2025-41737 (published 2025-11-18)
Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: metz-connect
Affected products: ewio2-bm, ewio2-bm_firmware, ewio2-m, ewio2-m-bm, ewio2-m-bm_firmware, ewio2-m_firmware
CVE-2025-41738 (published 2025-12-01)
An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-843
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_arm_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_sl, control_rte_sl_\(for_beckhoff_cx\), control_win_sl, hmi_sl, remote_target_visu, runtime_toolkit, virtual_control_sl
CVE-2025-41739 (published 2025-12-01)
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
CVE-2025-41742 (published 2025-12-02)
Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1394
Affected vendors: sprecher-automation
Affected products: sprecon-e-c, sprecon-e-c_firmware, sprecon-e-p, sprecon-e-p_firmware, sprecon-e-t3, sprecon-e-t3_firmware
CVE-2025-41743 (published 2025-12-02)
Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thus obtain limited information about the architecture and internal processes.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-326
Affected vendors: sprecher-automation
Affected products: sprecon-e-c, sprecon-e-c_firmware, sprecon-e-p, sprecon-e-p_firmware, sprecon-e-t3, sprecon-e-t3_firmware
CVE-2025-41744 (published 2025-12-02)
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-1394
Affected vendors: sprecher-automation
Affected products: sprecon-e-c, sprecon-e-c_firmware, sprecon-e-p, sprecon-e-p_firmware, sprecon-e-t3, sprecon-e-t3_firmware
CVE-2025-41745 (published 2025-12-09)
An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41746 (published 2025-12-09)
An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41747 (published 2025-12-09)
An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41748 (published 2025-12-09)
An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41749 (published 2025-12-09)
An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41750 (published 2025-12-09)
An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41751 (published 2025-12-09)
An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41752 (published 2025-12-09)
An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: phoenixcontact
Affected products: fl_nat_2008, fl_nat_2008_firmware, fl_nat_2208, fl_nat_2208_firmware, fl_nat_2304-2gc-2sfp, fl_nat_2304-2gc-2sfp_firmware, fl_switch_2005, fl_switch_2005_firmware, fl_switch_2008, fl_switch_2008_firmware, fl_switch_2008f, fl_switch_2008f_firmware, fl_switch_2016, fl_switch_2016_firmware, fl_switch_2105, fl_switch_2105_firmware, fl_switch_2108, fl_switch_2108_firmware, fl_switch_2116, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205, fl_switch_2205_firmware, fl_switch_2206-2fx
CVE-2025-41754 (published 2026-03-09)
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-1242
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41755 (published 2026-03-09)
A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint accepts a parameter specifying the log file to open (e.g., /tmp/weblog{some_number}), but this parameter is not properly validated, allowing an attacker to modify it to reference any file and retrieve its contents.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41756 (published 2026-03-09)
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-1242
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41757 (published 2026-03-09)
A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the contents of the backup archive to create or overwrite arbitrary files anywhere on the system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41758 (published 2026-03-09)
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41759 (published 2026-03-09)
An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-636
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41760 (published 2026-03-09)
An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-636
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41761 (published 2026-03-09)
A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-88
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41762 (published 2026-03-09)
An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-328
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41763 (published 2026-03-09)
A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-497
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41764 (published 2026-03-09)
Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-862
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41765 (published 2026-03-09)
Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-862
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41766 (published 2026-03-09)
A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41767 (published 2026-03-09)
A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-41768 (published 2026-01-20)
An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
Weakness: CWE-79
CVE-2025-41772 (published 2026-03-09)
An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-598
Affected vendors: mbs-solutions
Affected products: ubr-01_mk_ii, ubr-02, ubr-lon, universal_bacnet_router_firmware
CVE-2025-4202 (published 2026-05-16)
The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf_add_comment' function in all versions up to, and including, 5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to arbitrary collaborations.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862
CVE-2025-4203 (published 2025-10-25)
The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The function blindly interpolates 'row_count' into a 'LIMIT offset,row_count' clause using esc_sql() rather than enforcing numeric values. MySQL 5.x’s grammar allows a 'PROCEDURE ANALYSE' clause immediately after a LIMIT clause. Unauthenticated attackers controlling 'row_count' can append a stored‐procedure call, enabling error‐based or time‐based blind SQL injection that can be used to extract sensitive information from the database.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-89
CVE-2025-4212 (published 2025-11-18)
The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in image files that will execute whenever a user accesses the injected page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
Weakness: CWE-79
CVE-2025-4225 (published 2025-08-27)
An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: gitlab
Affected products: gitlab
CVE-2025-4234 (published 2025-09-12)
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
Severity: LOW (CVSS 4.0 vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber)
Weakness: CWE-532
CVE-2025-4235 (published 2025-09-12)
An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific non-default configurations. This allows an unprivileged Domain User to escalate privileges by exploiting the account’s permissions. The impact varies by configuration:
  *  Minimally Privileged Accounts: Enable disruption of User-ID Credential Agent operations (e.g., uninstalling or disabling the agent service), weakening network security policies that leverage  Credential Phishing Prevention https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention  under a  Domain Credential Filter https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention/methods-to-check-for-corporate-credential-submissions  configuration.
  *  Elevated Accounts (Server Operator, Domain Join, Legacy Features): Permit increased impacts, including server control (e.g., shutdown/restart), domain manipulation (e.g., rogue computer objects), and network compromise via reconnaissance or client probing.
Severity: HIGH (CVSS 4.0 vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber)
Weakness: CWE-497
CVE-2025-42611 (published 2026-05-05)
RouterOS provides various services that rely on correct
verification of client and server certificates to secure confidentiality and
integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X),
among others.



The vulnerability lies in shared certificate validation
logic which uses the system certificate store that is shared and equally
trusted by all system services. This causes confusion of scope, allowing any
certificate authority present in the system-wide trust store to be trusted in
any context (with some exceptions), allowing partial or full authentication
bypass in CAPsMAN, OpenVPN, Dot1X and potentially others.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-295
CVE-2025-42615 (published 2025-12-08)
In affected versions, vulnerability-lookup did not track or limit failed
 One-Time Password (OTP) attempts during Two-Factor Authentication (2FA)
 verification. An attacker who already knew or guessed a valid username 
and password could submit an arbitrary number of OTP codes without 
causing the account to be locked or generating any specific alert for 
administrators.


This lack of rate-limiting and lockout on OTP failures significantly 
lowers the cost of online brute-force attacks against 2FA codes and 
increases the risk of successful account takeover, especially if OTP 
entropy is reduced (e.g. short numeric codes, user reuse, or predictable
 tokens). Additionally, administrators had no direct visibility into 
accounts experiencing repeated 2FA failures, making targeted attacks 
harder to detect and investigate.


The patch introduces a persistent failed_otp_attempts counter on user 
accounts, locks the user after 5 invalid OTP submissions, resets the 
counter on successful verification, and surfaces failed 2FA attempts in 
the admin user list. This enforces an account lockout policy for OTP 
brute-force attempts and improves monitoring capabilities for suspicious
 2FA activity.This issue affects Vulnerability-Lookup: before 2.18.0.
Severity: HIGH (CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Weakness: CWE-307