CVE-2025-47699

CVE-2025-47699 affects Gallagher Command Centre Server via the Morpho integration. Root cause: Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Affected versions: 9.30 before 9.30.2482 (MR2), 9.20 before 9.20.2819 (MR4), 9.10 before 9.10.3672 (MR7), 9.00 befor...

CVE-2025-41402

Client-Side Enforcement of Server-Side Security CWE-602 in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to...

CVE-2025-41402

Client-Side Enforcement of Server-Side Security CWE-602 in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to...

CVE-2025-35981

Exposure of Private Personal Information to an Unauthorized Actor CWE-359 in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 MR1, 9.20.2337...

EUVD-2025-35651

Exposure of Private Personal Information to an Unauthorized Actor CWE-359 in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 MR1, 9.20.2337...

CVE-2025-35981

Exposure of Private Personal Information to an Unauthorized Actor CWE-359 in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 MR1, 9.20.2337...

CVE-2025-48430: Uncaught Exception

Uncaught Exception CWE-248 in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to vEL9.10.3672 MR7, 9.00 prior to...

CVE-2025-35981: Exposure of Private Personal Information to an Unauthorized Actor

Exposure of Private Personal Information to an Unauthorized Actor CWE-359 in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 MR1, 9.20.2337...

CVE-2025-47699: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue affects Command Centre Server: 9.30 prior to...

PT-2025-43422

Name of the Vulnerable Software and Affected Versions Command Centre Server versions 9.00 and prior Command Centre Server versions 9.10 through 9.10.3672 Command Centre Server versions 9.20 through 9.20.2819 Command Centre Server versions 9.30 through 9.30.2482 Description A flaw exists in the...

Gallagher Command Centre Server security vulnerability

Gallagher Command Centre Server is a management system for monitoring and managing infrastructure in buildings from Gallagher New Zealand. A security vulnerability exists in Gallagher Command Centre Server versions 9.30.1874, 9.20.2337, and 9.10.3194, which stems from a privileged operator being...

Gallagher Command Centre Server security vulnerability

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Centre Server that stems from improper enforcement of server-side security mechanisms on the client side,...

Gallagher Command Centre Server security vulnerability

Gallagher Command Centre Server is a management system for monitoring and managing infrastructure in buildings from Gallagher New Zealand. A security vulnerability exists in Gallagher Command Centre Server that stems from an uncaught exception that could cause an authorized privileged operator to...

CVE-2025-41402: Client-Side Enforcement of Server-Side Security

Client-Side Enforcement of Server-Side Security CWE-602 in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to...

PT-2025-43421

Name of the Vulnerable Software and Affected Versions Command Centre Server versions 9.10.3194 MR6, 9.20.2337 MR3, and 9.30.1874 MR1 Description A flaw exists in Command Centre Server that could allow a privileged Operator to view limited personal data about a Cardholder that they would not...

EUVD-2025-26474

A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes information disclosure. It is possible to initiate the attack remotely. The exploit has been published and may be used...

GHSA-495J-H493-42Q2 Strapi Allows Unauthorized Access to Private Fields via parms.lookup

Summary It's possible to access any private fields by filtering through the lookup parameters Details Using the new lookup operator provided by the document service in Strapi 5, it is not properly sanitizing this query operator for private fields. PoC 1. Create a strapi app. 2. Create a...

Strapi Allows Unauthorized Access to Private Fields via parms.lookup

Summary It's possible to access any private fields by filtering through the lookup parameters Details Using the new lookup operator provided by the document service in Strapi 5, it is not properly sanitizing this query operator for private fields. PoC 1. Create a strapi app. 2. Create a...

Authorization Bypass Through User-Controlled Key

Overview @strapi/core is a Core of Strapi Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the lookup operator in the document service due to improper sanitization of query operator for private fields . An attacker can retrieve sensitive...

CVE-2024-56143

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset...