CVE-2019-1010008

OpenEnergyMonitor Project Emoncms 9.8.8 is affected by a Cross Site Scripting (XSS) vulnerability. The issue involves JavaScript code execution in the fields Name, Location, Bio, and Starting Page on the My Account page, via Lib/listjs/list.js (line 67). The attack vector is listed as unknown, wi...

CVE-2025-22992

A SQL Injection vulnerability exists in the Emoncms project (versions 11.6.9 and later ). The flaw is located in the /feed/insert.json endpoint, where improper handling of user-supplied input in the data query parameter allows an attacker to execute arbitrary SQL commands under specific condition...

CVE-2021-26716

EMONCMS CVE-2021-26716 affects Modules/input/Views/schedule.php in Emoncms through 10.2.7, enabling cross-site scripting via the node parameter. The data from connected sources confirms the vulnerable component and version scope (10.2.7 and earlier) and the input parameter that can be exploited. ...

CVE-2017-5964

The CVE affects Emoncms up to version 9.8.0, where insufficient filtering of user-supplied data in multiple HTTP GET parameters passed to emoncms-master/Modules/vis/visualisations/compare.php allows an attacker to inject arbitrary HTML/JavaScript in a victim’s browser. The issue is caused by inad...

CVE-2025-60936

The open-source web application Emoncms version 11.7.3 is vulnerable to a Cross-Site Scripting (XSS) flaw within its input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicious JavaScript code. The injected script executes when an administrator ...

CVE-2025-60938

Emoncms version 11.7.3 is vulnerable to remote code execution (RCE) due to insufficient input validation in its firmware upload feature. Authenticated users can exploit this by sending unsanitized parameters—including filename, port, baud_rate, core, and autoreset—to the /admin/upload-custom-firm...