CVE-2025-62649: Use of Client-Side Authentication

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders...

PT-2025-42661

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description A remote attacker can adjust the Drive Thru speaker audio volume. The affected platform is Restaurant Brands International RBI assistant...

PT-2025-42656

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions prior to 2025-09-07 Description The Restaurant Brands International RBI assistant platform transmits user account passwords in cleartext email messages. Recommendations Update the...

PT-2025-42662

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform through 2025-09-06 utilizes client-side authentication when submitting equipment orders...

PT-2025-42659

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The RBI assistant platform allows remote attackers to review stored audio recordings of conversations between associates and Drive Thru customers...

PT-2025-42655

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The platform contains a signup API, named "Anyone Can Join This Party", that lacks user account creation verification. This allows a remote,...

PT-2025-42663

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform has a client-side authentication flaw that allows attackers to bypass access controls for...

CVE-2025-62642

The Restaurant Brands International RBI assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account...

PT-2025-42658

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform allows a remote authenticated attacker to obtain a token with administrative privileges f...

CVE-2025-62651

CVE-2025-62651 affects Restaurant Brands International’s assistant platform up to 2025-09-06, which does not implement access control for the bathroom rating interface. The record provides CVSS metrics: CVSS v3.1 base score 5.8 (NVD) / 6.5 (CNA), both indicating Medium severity with network acces...

CVE-2025-62647: Incorrect Authorization

The Restaurant Brands International RBI assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path...

PT-2025-42657

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform’s Global Store Directory shares personal information among authenticated users...

PT-2025-42660

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform through 2025-09-06 allows obtaining a JWT JSON Web Token which can be used to call an API...

Restaurant Brands International assistant platform 安全漏洞

Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in the Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from an unimplemented access control ...

CVE-2025-62643

The RBI assistant platform (Restaurant Brands International) through 2025-09-06 is affected by multiple interconnected issues. Public sources describe a remote, unauthenticated signup weakness via an open signup API, enabling account creation without proper verification, and a separate vulnerabil...

Restaurant Brands International assistant platform 安全漏洞

Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in the Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from a dependency on client...

Restaurant Brands International assistant platform 安全漏洞

Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from the transmission of user account...

Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name

Summary An authenticated party can add a malicious name to the Energy entity, allowing for Cross-Site Scripting attacks against anyone who can see the Energy dashboard, when they hover over any information point The blue bar in the picture below An alternative, and more impactful scenario, is tha...

GHSA-MQ77-RV97-285M Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name

Summary An authenticated party can add a malicious name to the Energy entity, allowing for Cross-Site Scripting attacks against anyone who can see the Energy dashboard, when they hover over any information point The blue bar in the picture below An alternative, and more impactful scenario, is tha...

CVE-2025-62172

Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript code into an energy entity's name fiel...