CVE-2025-27454

The application is vulnerable to cross-site request forgery. An attacker can trick a valid, logged in user into submitting a web request that they did not intend. The request uses the victim's browser's saved authorization to execute the request...

CVE-2025-27448

The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when the website is loaded...

CVE-2025-27448

The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when the website is loaded...

CVE-2025-27447

The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’s browser when an authenticated administrator clicks the link...

CVE-2025-27447

The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’s browser when an authenticated administrator clicks the link...

CVE-2025-27455 CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-27455 CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-27455

CVE-2025-27455 is linked to a clickjacking vulnerability in Endress+Hauser MEAC300-FNADE4 web interface (end-user frame embedding allowed). Connected sources confirm the affected product and vulnerability class but do not provide a confirmed patch/version fix; one PT-SEC source notes no available...

CVE-2025-27452 CVE-2025-27452

The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not required for the operation of the FNADE4 web application. The functionality of the some modules pose a risk to the webserver which enable...

CVE-2025-27452

CVE-2025-27452 describes a misconfiguration in the Apache httpd server that serves Endress+Hauser MEAC300-FNADE4. The issue arises from activating modules that are not required for the FNADE4 web application, creating a risk of directory listing. The available connected sources confirm the vulner...

CVE-2025-27448

CVE-2025-27448 affects Endress+Hauser MEAC300-FNADE4 web interface. The vulnerability is a cross-site scripting (XSS) flaw caused by improper validation of user input in the dashboard name. An attacker who can create dashboards can inject JavaScript into the dashboard name, which executes when th...

CVE-2025-27448 CVE-2025-27448

The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when the website is loaded...

CVE-2025-27448 CVE-2025-27448

The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when the website is loaded...

CVE-2025-27447 CVE-2025-27447

The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’s browser when an authenticated administrator clicks the link...

CVE-2025-27447 CVE-2025-27447

The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’s browser when an authenticated administrator clicks the link...

CVE-2025-27447

CVE-2025-27447 involves a cross-site scripting vulnerability in Endress+Hauser MEAC300-FNADE4. The weakness arises from insufficient filtering/escaping of user-supplied data, enabling an attacker to craft a URL that injects JavaScript executed in an authenticated administrator’s browser when the ...

Endress+Hauser MEAC300-FNADE4 安全漏洞

The Endress+Hauser MEAC300-FNADE4 is a cost-effective emissions data management computer from Endress+Hauser Vietnam. The Endress+Hauser MEAC300-FNADE4 suffers from a cross-site request forgery vulnerability that arises from a WEB application that does not adequately validate that a request is...

PT-2025-27776

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’...

PT-2025-27777 · Endress+Hauser · Endress+Hauser Meac300-Fnade4

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when t...

The vulnerability of the http-foundation component of the Symfony software development and web application management platform allows attackers to access confidential data.

The vulnerability of the http-foundation component of the Symfony software development and web application management platform is related to the use of open redirection. Exploiting this vulnerability could allow an attacker to gain access to confidential data...