Explore CVE records

HighPublished 22 Dec 2025, 21:32 WIB

CVE-2025-61740

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.

Excerpt language: en.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 23:20 WIB

Official record

HighPublished 22 Dec 2025, 21:21 WIB

CVE-2025-26379

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator

Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.

Excerpt language: en.

HighPublished 22 Dec 2025, 20:46 WIB

CVE-2025-14018

Unquoted Service Path in NetBT Consultancy's e-Fatura

Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redirect Access to Libraries. This issue affects e-Fatura: before 1.2.15.

Excerpt language: en.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated04 Jun 2026, 13:29 WIB

Official record

HighPublished 22 Dec 2025, 18:24 WIB

CVE-2025-14273

Mattermost Jira plugin user spoofing enables Jira request forgery.

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated22 Dec 2025, 19:59 WIB

Official record

MedPublished 22 Dec 2025, 18:07 WIB

CVE-2025-54890

A user with elevated privileges can inject XSS in the Hostgroups configuration page

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19, fro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated05 Jan 2026, 16:51 WIB

Official record

HighPublished 22 Dec 2025, 17:59 WIB

CVE-2025-12514

A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parameters

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules) allows SQL Injection to user with elevated privileges.This issue affects Infra Monitoring - Open-tickets: f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated05 Jan 2026, 16:52 WIB

Official record

MedPublished 22 Dec 2025, 17:55 WIB

CVE-2025-8460

A user with elevated privileges can inject XSS in the Notification rules configuration page

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from 24.04.0 before 2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated05 Jan 2026, 16:51 WIB

Official record

HighPublished 22 Dec 2025, 17:19 WIB

CVE-2025-61739

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption

Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.

Excerpt language: en.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 20:09 WIB

Official record

LowPublished 22 Dec 2025, 17:07 WIB

CVE-2025-61738

Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information

Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.

Excerpt language: en.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 21:09 WIB

Official record

MedPublished 22 Dec 2025, 16:47 WIB

CVE-2025-62094

WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidthemes Void Elementor WHMCS Elements For Elementor Page Builder void-elementor-whmcs-elements.This issue affects Void Elementor WHMCS Elements For Elementor Page Builder: from n/a through <= 2.0.1.2.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 22 Dec 2025, 16:32 WIB

CVE-2025-62107

WordPress Feather Login Page plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather Login Page: from n/a through <= 1.1.7.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 22 Dec 2025, 16:31 WIB

CVE-2025-62880

WordPress Custom 404 Pro plugin <= 3.12.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Kunal Custom 404 Pro custom-404-pro allows Cross Site Request Forgery.This issue affects Custom 404 Pro: from n/a through <= 3.12.0.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 22 Dec 2025, 14:58 WIB

CVE-2025-8305

Information Disclosure in Identity Agent Debug Files

An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Dec 2025, 20:55 WIB

Official record

MedPublished 22 Dec 2025, 14:57 WIB

CVE-2025-8304

Information Disclosure in Identity Agent Registry Keys

An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being accessible in the Windows Registry keys for Check Point Identity Agent running on a Terminal Server.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated23 Dec 2025, 00:05 WIB

Official record

CritPublished 22 Dec 2025, 12:18 WIB

CVE-2025-11545

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sharp Display Solutions projectors allows a attacker may improperly access the HTTP server and execute arbitrary actions.

Excerpt language: en.

CVSS9.5v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 21:32 WIB

Official record

CritPublished 22 Dec 2025, 12:14 WIB

CVE-2025-11544

Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.

Excerpt language: en.

CVSS9.5v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 21:33 WIB

Official record

CritPublished 22 Dec 2025, 12:09 WIB

CVE-2025-11543

Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.

Excerpt language: en.

CVSS9.5v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 21:33 WIB

Official record

HighPublished 22 Dec 2025, 12:09 WIB

CVE-2025-11542

Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs.

Excerpt language: en.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 21:34 WIB

Official record

CritPublished 22 Dec 2025, 12:09 WIB

CVE-2025-11541

Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs.

Excerpt language: en.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 21:39 WIB

Official record

CritPublished 22 Dec 2025, 12:07 WIB

CVE-2025-11540

Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector.

Excerpt language: en.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 00:06 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage