Find the CVE cohort

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Global Gallery allows Reflected XSS. This issue affects Global Gallery: from n/a through 8.8.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:53:09.352Z. Updated 2026-04-28T16:10:57.738Z.

Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:50:38.887Z. Updated 2025-04-16T15:07:42.292Z.

Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:48:21.025Z. Updated 2025-04-16T15:07:51.202Z.

Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:45:46.649Z. Updated 2025-04-16T14:41:18.922Z.

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:43:15.834Z. Updated 2025-04-16T14:41:30.177Z.

Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:39:24.102Z. Updated 2025-04-16T14:41:36.761Z.

An attacker can upload an arbitrary file instead of a plant image.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:36:07.191Z. Updated 2025-04-16T14:41:51.796Z.

An attacker can export other users' plant information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:33:05.892Z. Updated 2025-04-16T14:42:11.964Z.

An unauthenticated attacker can hijack other users' devices and potentially control them.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:25:26.240Z. Updated 2025-04-16T15:08:00.599Z.

An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:23:08.714Z. Updated 2025-04-16T15:08:10.427Z.

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:18:15.913Z. Updated 2025-04-16T15:08:19.282Z.

An unauthenticated attacker can obtain EV charger energy consumption information of other users.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:16:16.331Z. Updated 2025-04-16T15:08:28.970Z.

An unauthenticated attacker can obtain other users' charger information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:14:18.106Z. Updated 2025-04-16T15:08:40.373Z.

Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:12:13.452Z. Updated 2025-04-16T15:08:48.134Z.

Unauthenticated attackers can query an API endpoint and get device details.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:09:29.425Z. Updated 2025-04-16T15:08:56.430Z.

An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:07:32.609Z. Updated 2025-04-16T15:09:04.278Z.

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:05:11.863Z. Updated 2025-04-16T15:09:11.768Z.

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-15T21:03:24.435Z. Updated 2025-04-16T15:09:20.673Z.