CVE-2025-27214

The UniFi Connect EV Station Pro (versions 1.5.18 and earlier ) is vulnerable to a Missing Authentication for Critical Function (CWE-306) security flaw. A malicious actor with physical or adjacent access can exploit this lack of authentication to perform an unauthorized factory reset . To remedia...

CVE-2025-27214

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset. Affected Products: UniFi Connect EV Station Pro Version 1.5.18 and earlier Mitigation: Update Uni...

CVE-2025-55524: Incorrect Permission Assignment for Critical Resource

Insecure permissions in Agent-Zero v0.8. allow attackers to arbitrarily reset the system via unspecified vectors...

CVE-2025-55366: Improper Access Control

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack...

CVE-2025-27214: Missing Authentication for Critical Function

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset. Affected Products: UniFi Connect EV Station Pro Version 1.5.18 and earlier Mitigation: Update Uni...

PT-2025-34266

Name of the Vulnerable Software and Affected Versions: Agent-Zero versions 0.8.0 through 0.8.9 Description: Insecure permissions in Agent-Zero allow attackers to arbitrarily reset the system via unspecified vectors. Recommendations: At the moment, there is no information about a newer version tha...

PT-2025-34234 · Unknown · Roadcute Api

Name of the Vulnerable Software and Affected Versions: Roadcute API version 1 Description: An issue in the application allows a remote attacker to execute arbitrary code via an insecure password reset API endpoint. The endpoint fails to validate the identity of the requester properly...

CVE-2025-55366

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack...

CVE-2025-55524

Insecure permissions in Agent-Zero v0.8. allow attackers to arbitrarily reset the system via unspecified vectors...

Ubiquiti UniFi Connect EV Station security vulnerabilities

Ubiquiti UniFi Connect EV Station is an electric vehicle station from Ubiquiti USA. A security vulnerability exists in the Ubiquiti UniFi Connect EV Station version 1.5.18 and earlier, which stems from a lack of authentication for critical functions and could result in an unauthorized restoration...

Roadcube API security vulnerabilities

Roadcube API is a management interface software from Roadcube Greece. A security vulnerability exists in the Roadcube API v.1 version that stems from a password reset API endpoint that does not validate the identity of the requester, which could lead to the execution of arbitrary code...

Agent Zero security vulnerability

Agent Zero is an artificial intelligence framework by the individual developer Jan Tomášek. A security vulnerability exists in Agent Zero version v0.8, which stems from improper permissions and could lead to a system reset...

PT-2025-34173 · Ubiquiti · Unifi Connect Ev Station Pro

Name of the Vulnerable Software and Affected Versions: UniFi Connect EV Station Pro versions 1.5.18 and earlier Description: A missing authentication check for critical functions in UniFi Connect EV Station Pro could allow an attacker with physical or adjacent access to perform an unauthorized...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

CVE-2025-52395

A security vulnerability exists in Roadcute API v.1 (also referred to as Roadcube API) involving a password reset API endpoint . The root cause is a failure to properly validate the identity of the requester, which allows a remote attacker to achieve arbitrary code execution . The vulnerability i...

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...

CVE-2025-55524

Insecure permissions in Agent-Zero v0.8. allow attackers to arbitrarily reset the system via unspecified vectors...

CVE-2025-55524

The artificial intelligence framework Agent-Zero (versions 0.8.0 through 0.8.9 ) is affected by CVE-2025-55524 . The vulnerability is caused by incorrect permission assignment for critical resources, which allows an attacker to arbitrarily reset the system via unspecified vectors. While the speci...

CVE-2025-55524

Insecure permissions in Agent-Zero v0.8. allow attackers to arbitrarily reset the system via unspecified vectors...

CVE-2025-52395: Improper Authentication

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly...