PT-2025-42662

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform through 2025-09-06 utilizes client-side authentication when submitting equipment orders...

PT-2025-42663

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform has a client-side authentication flaw that allows attackers to bypass access controls for...

CVE-2025-62649: Use of Client-Side Authentication

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders...

CVE-2025-62650: Use of Client-Side Authentication

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen...

CVE-2025-62649

The RBI assistant platform (through 2025-09-06) relies on client-side authentication for submission of equipment orders, per CVE-2025-62649 and related CSAF/VIs. The connected ics/CSAF entries describe multiple issues, including: a remote unauthenticated attacker being able to create an account v...

CVE-2025-62650

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen...

CVE-2025-62649

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders...

CVE-2025-62650

The RBI assistant platform (through 2025-09-06) relies on client-side authentication for key functions, widening attack surface. Connected documents enumerate concrete issues: an unauthenticated remote signup API allows account creation; cleartext transmission of passwords via email; a GraphQL cr...

CVE-2025-62649

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders...

EUVD-2025-34922

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen...

CVE-2025-62379

Reflex (Python web app framework) versions 0.5.4–0.8.14 contain an Open Redirect in the /auth-codespace route: the redirect_to query parameter is assigned directly to client-side links without validation, triggering automatic navigation, which can redirect users to arbitrary external URLs. The vu...

EUVD-2025-34466

Stored Cross-Site Scripting XSS in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A...

CVE-2025-10720

The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password...

CVE-2025-60374

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Perfex CRM chatbot module in versions prior to 3.3.1 . The flaw stems from insufficient input validation of the chatbot message parameter and a lack of output encoding when rendering stored messages. Attackers can inject arbitrary HT...

CVE-2025-60374: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A...

CVE-2025-60374

Stored Cross-Site Scripting XSS in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A...

CVE-2025-2139

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security...

CVE-2025-2138

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security...

EUVD-2025-34063

The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password...

Why Unmonitored JavaScript Is Your Biggest Holiday Security Risk

Think your WAF has you covered? Think again. This holiday season, unmonitored JavaScript is a critical oversight allowing attackers to steal payment data while your WAF and intrusion detection systems see nothing. With the 2025 shopping season weeks away, visibility gaps must close now. Get the...