CVE-2025-31357

CVE-2025-31357 affects Growatt Cloud Applications (cloud portal). The connected documents describe an information-disclosure vulnerability where an unauthenticated attacker can obtain a user’s plant list by knowing the username. Evidence of the issue appears across multiple sources (CVE lists, CN...

CVE-2025-31357 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain a user's plant list by knowing the username...

CVE-2025-31933 Growatt Cloud Applications Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can check the existence of usernames in the system by querying an API...

CVE-2025-31933 Growatt Cloud Applications Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can check the existence of usernames in the system by querying an API...

CVE-2025-32012 Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing

Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrators the ability to restart their Jellyfin server. This endpoint is intended to be admins-only, but it also authorizes requests from any device in the same...

PT-2025-16498

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An unauthenticated attacker can obtain a list of smart devices by knowing a valid username through an unprotected API. Recommendations At the moment, there is no information about a newer...

PT-2025-16483

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An unauthenticated attacker can hijack other users' devices and potentially control them. Recommendations At the moment, there is no information about a newer version that contains a fix for...

PT-2025-16425

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 21.0.6 through 24 Oracle GraalVM for JDK versions 21.0.6 through 24 Description The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, resulting in...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which originates from an unauthenticated attacker who can hijack another user's device...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which originates from an unauthenticated attacker being able to rename any user's device...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from China-based Growatt. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and prior versions, which can be exploited by an unauthenticated attacker to obtain the serial number of a smart meter associated with a specif...

PT-2025-16485

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. Recommendations At the moment, there is no information about a newer version that contains a fix f...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and earlier, which originates from an unauthenticated attacker being able to obtain the serial number of a smart meter...

CVE-2025-2572

In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup...

CVE-2025-2572 WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability

In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup...

CVE-2025-2572 WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability

In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup...

PT-2025-16257 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2024.0.3 Description: A database manipulation issue allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup. This enables attackers to tamper with the database without...

📄 Langflow AI Remote Code Execution

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2025-3439

The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input from the 'fieldvalue' parameter. This makes it possible for...

CVE-2025-0122

A denial-of-service DoS vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device...