CVE-2019-1010008

OpenEnergyMonitor Project Emoncms 9.8.8 is affected by a Cross Site Scripting (XSS) vulnerability. The issue involves JavaScript code execution in the fields Name, Location, Bio, and Starting Page on the My Account page, via Lib/listjs/list.js (line 67). The attack vector is listed as unknown, wi...

CVE-2025-22992

A SQL Injection vulnerability exists in the Emoncms project (versions 11.6.9 and later ). The flaw is located in the /feed/insert.json endpoint, where improper handling of user-supplied input in the data query parameter allows an attacker to execute arbitrary SQL commands under specific condition...

CVE-2021-26716

EMONCMS CVE-2021-26716 affects Modules/input/Views/schedule.php in Emoncms through 10.2.7, enabling cross-site scripting via the node parameter. The data from connected sources confirms the vulnerable component and version scope (10.2.7 and earlier) and the input parameter that can be exploited. ...

CVE-2017-5964

The CVE affects Emoncms up to version 9.8.0, where insufficient filtering of user-supplied data in multiple HTTP GET parameters passed to emoncms-master/Modules/vis/visualisations/compare.php allows an attacker to inject arbitrary HTML/JavaScript in a victim’s browser. The issue is caused by inad...

CVE-2025-60936

The open-source web application Emoncms version 11.7.3 is vulnerable to a Cross-Site Scripting (XSS) flaw within its input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicious JavaScript code. The injected script executes when an administrator ...

CVE-2025-60938

Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baud_rate,...