CVE-2025-31945 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain other users' charger information...

CVE-2025-26857 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename arbitrary devices of arbitrary users i.e., EV chargers...

CVE-2025-26857

CVE-2025-26857 affects Growatt Cloud Applications (vulnerable through 3.6.0 and earlier according to CNNVD). The flaw allows an unauthenticated attacker to rename arbitrary devices owned by any user (notably EV chargers) by exploiting insufficient input validation. Multiple connected sources (Red...

CVE-2025-27719

CVE-2025-27719 affects Growatt Cloud Applications (Growatt Cloud portal). An unauthenticated user can query an API endpoint and obtain device details, indicating an information-disclosure risk. Connected sources indicate this vulnerability exists in Growatt Cloud Applications version 3.6.0 and ea...

CVE-2025-31654

CVE-2025-31654 concerns Growatt Cloud Applications where an attacker can obtain information about the groups of smart home devices for arbitrary users (i.e., the users’ “rooms”). The CVE appears across multiple sources (NVD, Red Hat, CVE List, CVSS metrics) and is associated with the Growatt clou...

CVE-2025-27938

Growatt Cloud Applications (Growatt Cloud portal) suffers an unauthenticated authorization bypass that allows access to restricted user “rooms” information. Public docs indicate this affects versions up to 3.6.0 (and prior) and that no patch version is specified; exploitation status not publicly ...

CVE-2025-27939 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can change registered email addresses of other users and take over arbitrary accounts...

CVE-2025-27939 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can change registered email addresses of other users and take over arbitrary accounts...

CVE-2025-27939

CVE-2025-27939 affects Growatt Cloud Applications (version 3.6.0 and earlier per CNNVD) where an attacker can change other users’ registered email addresses and take over arbitrary accounts. The connected sources confirm the issue exists across Growatt Cloud Apps and describe account takeover via...

CVE-2025-30254

CVE-2025-30254 affects Growatt Cloud Applications (noted in multiple feeds). The CSC-grade description shows an unauthenticated attacker can obtain a meter serial number by querying with a user’s username. CNNVD-202504-2298 specifies vulnerable versions up to 3.6.0 and earlier; other sources reit...

CVE-2025-27568 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request...

CVE-2025-27568

Growatt Cloud Portal (Growatt Cloud Applications) is affected by CVE-2025-27568, where an unauthenticated attacker can determine a user’s email by knowing the username, causing a password-reset email to be sent. Public documents reference the authorization bypass exposure without detailing a fixe...

CVE-2025-24487 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can infer the existence of usernames in the system by querying an API...

CVE-2025-31949 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An authenticated attacker can obtain any plant name by knowing the plant ID...

GHSA-RRJ2-PH5Q-JXW2 jquery-validation vulnerable to Cross-site Scripting

Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting XSS in the showLabel function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary...

CVE-2025-3573

Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting XSS in the showLabel function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary...

UBUNTU-CVE-2025-3573

Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting XSS in the showLabel function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary...

CVE-2025-3573

Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting XSS in the showLabel function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary...

CVE-2025-3573

CVE-2025-3573 concerns the jquery-validation library. Versions before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, where user-controlled input can be written into the localizable validator.messages dictionary. The vulnerability is described as input-driven and ...

PT-2025-16396

Name of the Vulnerable Software and Affected Versions Web-Check versions affected versions not specified Description A command injection issue exists in the screenshot API of the Web Check project, stemming from user-controlled input url being passed unsanitized into a shell command using exec,...