CVE-2025-7405

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not...

CVE-2025-52547

E3 Site Supervisor Control firmware version 2.31F01 MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services...

CVE-2025-7731

Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or write the device values of the product...

CVE-2025-7731

CVE-2025-7731 describes an information-disclosure vulnerability in Mitsubishi Electric MELSEC iQ-F Series CPU modules caused by cleartext transmission of sensitive information over SLMP. An unauthenticated remote attacker can intercept SLMP messages to obtain credentials, then read or write devic...

CVE-2025-7405 Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not...

CVE-2025-7405: Missing Authentication for Critical Function

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not...

Mitsubishi Electric MELSEC iQ-F Series CPU 访问控制错误漏洞

The Mitsubishi Electric MELSEC iQ-F Series CPUs are a series of CPU modules from Mitsubishi Electric Corporation Mitsubishi Electric, Japan. An access control error vulnerability exists in the Mitsubishi Electric MELSEC iQ-F Series CPUs, which stems from a lack of authentication of a critical...

PT-2025-35446

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module affected versions not specified Description: A cleartext transmission issue exists in the Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module. A remote, unauthenticated...

PT-2025-35445

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric MELSEC iQ-F Series CPU module affected versions not specified Description: A missing authentication feature in the MODBUS/TCP implementation of the Mitsubishi Electric MELSEC iQ-F Series CPU module allows a remote,...

CVE-2025-7731: Cleartext Transmission of Sensitive Information

Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or write the device values of the product...

CVE-2025-51971

A reflected Cross-Site Scripting XSS vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in the fname parameter is reflected in the server response without proper HTML encoding or output escaping. This allows remote attackers to injec...

CVE-2025-5514

Improper Handling of Length Parameter Inconsistency vulnerability in web server function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to delay the processing of the web server function and prevent legitimate users from utilizing the web...

The vulnerability of microprogrammed software for AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, and RFC 4072S logic controllers arises from incorrect definition of symbolic references before accessing files. This allows attackers to gain unauthorized access to read and write system files.

The vulnerability of microprogrammed software in logic controllers AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, and RFC 4072S is related to incorrect definition of symbolic references before accessing files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

The vulnerability of microprogrammed software for logic controllers AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, and RFC 4072S arises from errors in the use of standard permissions, allowing a perpetrator to trigger a service failure.

The vulnerability of microprogrammed software in logic controllers AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, and RFC 4072S is related to errors in the use of standard permissions. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

CVE-2025-51971

A reflected Cross-Site Scripting XSS vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in the fname parameter is reflected in the server response without proper HTML encoding or output escaping. This allows remote attackers to injec...

CISA Releases Nine Industrial Control Systems Advisories

CISA released nine Industrial Control Systems ICS advisories on August 28, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-240-01 Mitsubishi Electric MELSEC iQ-F Series CPU Module ICSA-25-240-02 Mitsubishi...

Mitsubishi Electric MELSEC iQ-F Series CPU Module

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker the ability to obtain credential information by intercepting SLMP communication messages, and read or write the device values of the product by using the obtained credential information. In addition, the...

Mitsubishi Electric MELSEC iQ-F Series CPU Module

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to read or write the device values of the product. In addition, the attacker may be able to stop the operation of the programs. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize...

CVE-2025-51971

A reflected Cross-Site Scripting XSS vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in the fname parameter is reflected in the server response without proper HTML encoding or output escaping. This allows remote attackers to injec...

PuneethReddyHc Online Shopping System Advanced 安全漏洞

PuneethReddyHc Online Shopping System Advanced is an open source online shopping system from the individual developers at Puneeth Reddy HC in India. A security vulnerability exists in PuneethReddyHc Online Shopping System Advanced version 1.0, which stems from the fname parameter not being cleane...