CVE-2025-4008

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...

CVE-2025-4008 Arbitrary Command Injection in Smartbedded MeteoBridge

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...

EUVD-2025-16032

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...

CVE-2025-48417 Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations

The certificate and private key used for providing transport layer security for connections to the web interface TCP port 443 is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin...

CVE-2025-48417 Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations

The certificate and private key used for providing transport layer security for connections to the web interface TCP port 443 is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin...

CVE-2025-48414

There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administrative/debug functionality and are likely intended for debugging during development and provides an additional attack surface...

CVE-2025-27803

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...

CVE-2025-48414

The eCharge Hardy Barth cPH2 and cPP2 charging stations (specifically version 2.2.0 ) are vulnerable to a trust management issue due to hard-coded credentials in several web interface scripts. These scripts provide access to additional administrative and debug functionality that was likely intend...

CVE-2025-48414 Hard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations

There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administrative/debug functionality and are likely intended for debugging during development and provides an additional attack surface...

CVE-2025-48414 Hard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations

There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administrative/debug functionality and are likely intended for debugging during development and provides an additional attack surface...

CVE-2025-4903

A vulnerability, which was classified as critical, was found in D-Link DI-7003GV2 24.04.18D1 R68125. This affects the function sub41F4F0 of the file /H5/webgl.asp?tgglport=0management=0passwd=gameservice=admin-restart. The manipulation leads to unverified password change. It is possible to initia...

Zabbix Web Interface Data Compromise

The vulnerability of Zabbix’s Web interface, the monitoring system for IT infrastructure, is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability allows a malicious actor to cause service failures or compromise the integrity of Zabbix’s Web...

Mini_http HTTP Server Unauthorized Access

The vulnerability of the HTTP server in the Minihttp embedded software of Netgear DGND3700 routers is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and gain unauthorized access to the device’s...

PT-2025-22382 · Cisco · Cisco Identity Services Engine

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of...

PT-2025-22343 · Echarge Hardy Barth · Cph2 / Cpp2 Charging Stations

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns several scripts in the web interface that are accessible via undocumented hard-coded credentials. These scripts provide access to additional administrative and debug...

CVE-2025-4008: Improper Neutralization of Special Elements used in a Command

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...

CVE-2025-27803: Missing Authentication for Critical Function

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...

Meteobridge security vulnerabilities

Meteobridge is a small device from Meteobridge that connects personal weather stations to public weather networks. A security vulnerability exists in Meteobridge that stems from a command injection vulnerability in the web interface endpoint that could allow an unauthenticated, remote attacker to...

Cisco Identity Services Engine security vulnerabilities

Cisco Identity Services Engine is an identity-centric solution designed to provide comprehensive identity and access management IAM capabilities. A cross-site scripting vulnerability exists in the Cisco Identity Services web interface, which can be exploited by remote attackers to inject maliciou...

JetBrains YouTrack access control vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. JetBrains YouTrack suffers from an Access Control Error vulnerability that stems from a lack...