1309 matches found
CVE-2024-52327: Use of Client-Side Authentication
The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...
ECOVACS robot lawnmowers 安全漏洞
ECOVACS robot lawnmowers is a series of lawnmowers from the Chinese company ECOVACS. A security vulnerability exists in ECOVACS robot lawnmowers that originates from storing the anti-theft PIN in plaintext in the device file system. An attacker could steal the lawnmower, read the PIN, and reset t...
CVE-2024-52331: Download of Code Without Integrity Check
ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot...
ECOVACS robot lawnmowers和vacuums 安全漏洞
ECOVACS robot vacuums and ECOVACS robot lawnmowers are both products of the Chinese company ECOVACS.ECOVACS robot vacuums are a line of vacuum cleaners.ECOVACS robot lawnmowers are a line of lawnmowers. The ECOVACS robot lawnmowers and vacuums suffer from a security vulnerability that stems from ...
CVE-2024-12078: Use of Hard-coded Cryptographic Key
ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...
PT-2025-1627 · Ecovacs · Ecovacs Robot Lawnmowers/Vacuums
Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns the use of a deterministic root password in ECOVACS robot lawnmowers and vacuums, which is generated based on the model and serial number. An...
CVE-2024-52325: Improper Neutralization of Special Elements used in a Command
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin over an unauthenticated BLE connection...
CVE-2024-52328: Incorrect Permission Assignment for Critical Resource
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on...
CVE-2025-22582
Cross-Site Request Forgery CSRF vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through = 0.1.3...
CVE-2025-22582 WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through = 0.1.3...
CVE-2025-22582
CVE-2025-22582 is a CSRF-to-Stored-XSS vulnerability in the Uptime Robot WordPress plugin (Scott Nellé) affecting versions from n/a up to 0.1.3. The Connected Red Hat doc reiterates the CSRF/Stored XSS description; no exploitation details are provided. CVSS v3.1 base score is 7.1 (HIGH). No patch...
CVE-2025-22582 WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Scott Nellé Uptime Robot allows Stored XSS.This issue affects Uptime Robot: from n/a through 0.1.3...
WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Uptime Robot versions = 0.1.3...
CVE-2025-22582: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through = 0.1.3...
PT-2025-4570 · Unknown · Uptime Robot
Name of the Vulnerable Software and Affected Versions: Uptime Robot versions 0.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and als...
WordPress plugin Uptime Robot 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...
Delta Electronics DRASimuCAD Type Obfuscation Vulnerability
Delta Electronics DRASimuCAD is an integrated platform for robot simulation. A type confusion vulnerability exists in Delta Electronics DRASimuCAD, which can be exploited by an attacker to execute arbitrary code in the context of the current process...
PT-2024-36279 · WordPress · Midoks Wp微信机器人
Name of the Vulnerable Software and Affected Versions: Midoks WP微信机器人 versions through 5.3.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also...
