https://vulnogram.org/ Most recent CVEs assigned by Dutch Institute for Vulnerability Disclosure (DIVD) (divd). https://vulnogram.org/seaview/icons/divd.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-102490 https://vulnogram.org/CVE-2026-102490 Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began… Critical Known Exploited Network Exploitable Wed, 30 Sep 2026 16:21:20 GMT https://vulnogram.org/CVE-2026-102489 https://vulnogram.org/CVE-2026-102489 Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying frame… Critical Known Exploited Network Exploitable Unsupported When Assigned Wed, 30 Sep 2026 16:21:19 GMT https://vulnogram.org/CVE-2026-22094 https://vulnogram.org/CVE-2026-22094 The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network. Critical Network Exploitable Tue, 29 Sep 2026 14:31:33 GMT https://vulnogram.org/CVE-2026-22101 https://vulnogram.org/CVE-2026-22101 The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password. Medium Tue, 29 Sep 2026 14:31:28 GMT https://vulnogram.org/CVE-2026-22104 https://vulnogram.org/CVE-2026-22104 Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance. High Fri, 17 Jul 2026 09:30:36 GMT https://vulnogram.org/CVE-2026-22103 https://vulnogram.org/CVE-2026-22103 The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. Critical Network Exploitable Mon, 13 Jul 2026 09:11:00 GMT https://vulnogram.org/CVE-2026-22098 https://vulnogram.org/CVE-2026-22098 Various sensitive information such as passwords and charging card UIDs are written to log files. Critical Network Exploitable Mon, 13 Jul 2026 09:10:59 GMT https://vulnogram.org/CVE-2026-22097 https://vulnogram.org/CVE-2026-22097 The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution. Critical Network Exploitable Mon, 13 Jul 2026 09:10:59 GMT https://vulnogram.org/CVE-2026-22099 https://vulnogram.org/CVE-2026-22099 The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL. High Mon, 13 Jul 2026 09:10:58 GMT https://vulnogram.org/CVE-2026-22102 https://vulnogram.org/CVE-2026-22102 A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service b… Critical Network Exploitable Mon, 13 Jul 2026 09:10:58 GMT https://vulnogram.org/CVE-2026-22096 https://vulnogram.org/CVE-2026-22096 The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints. Critical Network Exploitable Mon, 13 Jul 2026 09:10:57 GMT https://vulnogram.org/CVE-2026-22100 https://vulnogram.org/CVE-2026-22100 The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root. High Mon, 13 Jul 2026 09:10:57 GMT https://vulnogram.org/CVE-2026-22095 https://vulnogram.org/CVE-2026-22095 The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. Critical Network Exploitable Mon, 13 Jul 2026 09:10:56 GMT https://vulnogram.org/CVE-2026-22093 https://vulnogram.org/CVE-2026-22093 The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communi… Critical Network Exploitable Mon, 13 Jul 2026 09:10:56 GMT https://vulnogram.org/CVE-2025-36747 https://vulnogram.org/CVE-2025-36747 ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with… Critical Network Exploitable Sat, 13 Dec 2025 08:16:25 GMT https://vulnogram.org/CVE-2025-36752 https://vulnogram.org/CVE-2025-36752 Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectiv… Critical Sat, 13 Dec 2025 08:16:25 GMT https://vulnogram.org/CVE-2025-36754 https://vulnogram.org/CVE-2025-36754 The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an att… Critical Sat, 13 Dec 2025 08:16:24 GMT https://vulnogram.org/CVE-2025-36748 https://vulnogram.org/CVE-2025-36748 ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate use… High Sat, 13 Dec 2025 08:16:23 GMT https://vulnogram.org/CVE-2025-36750 https://vulnogram.org/CVE-2025-36750 ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page via a direct post. This may allow attackers to force a legitimate user’s browser’s JavaScript… High Sat, 13 Dec 2025 08:16:22 GMT https://vulnogram.org/CVE-2025-36753 https://vulnogram.org/CVE-2025-36753 The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device High Sat, 13 Dec 2025 08:16:22 GMT https://vulnogram.org/CVE-2025-36751 https://vulnogram.org/CVE-2025-36751 Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoin… Critical Sat, 13 Dec 2025 08:16:21 GMT https://vulnogram.org/CVE-2025-36746 https://vulnogram.org/CVE-2025-36746 SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt. Medium Cloud Hosted Fri, 12 Dec 2025 15:05:40 GMT https://vulnogram.org/CVE-2025-36743 https://vulnogram.org/CVE-2025-36743 SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and execution of debug commands. High Fri, 12 Dec 2025 15:05:39 GMT https://vulnogram.org/CVE-2025-36744 https://vulnogram.org/CVE-2025-36744 SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop. While the device repeatedly initializes and waits for boot instructions, the bootloader emits diagnostic output this behavior can leak operating sys… Low Fri, 12 Dec 2025 15:05:39 GMT https://vulnogram.org/CVE-2025-36745 https://vulnogram.org/CVE-2025-36745 SolarEdge SE3680H ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems. An attacker with network or local access can exploit these flaws to achieve remote code execution, privilege escalation, or disclosure of s… High Fri, 12 Dec 2025 15:05:38 GMT https://vulnogram.org/CVE-2025-36755 https://vulnogram.org/CVE-2025-36755 The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researchers demonstrated that, after cicumventing the device’s protective enclosure, it was possible… Low Fri, 12 Dec 2025 14:58:22 GMT https://vulnogram.org/CVE-2025-36759 https://vulnogram.org/CVE-2025-36759 Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user email addresses and phone numbers. High Network Exploitable Cloud Hosted Wed, 10 Sep 2025 08:50:56 GMT https://vulnogram.org/CVE-2025-36757 https://vulnogram.org/CVE-2025-36757 It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to bypass the login screen and gain limited access to the system. Medium Network Exploitable Cloud Hosted Wed, 10 Sep 2025 08:50:55 GMT https://vulnogram.org/CVE-2025-36758 https://vulnogram.org/CVE-2025-36758 It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Password' functionality as an oracle. Medium Network Exploitable Cloud Hosted Wed, 10 Sep 2025 08:50:54 GMT https://vulnogram.org/CVE-2025-36756 https://vulnogram.org/CVE-2025-36756 A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known. Medium Cloud Hosted Wed, 10 Sep 2025 08:50:53 GMT https://vulnogram.org/CVE-2025-29757 https://vulnogram.org/CVE-2025-29757 An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account. Critical Cloud Hosted Sat, 19 Jul 2025 05:15:36 GMT https://vulnogram.org/CVE-2025-29756 https://vulnogram.org/CVE-2025-29756 SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the… High Cloud Hosted Wed, 11 Jun 2025 08:01:16 GMT https://vulnogram.org/CVE-2025-22371 https://vulnogram.org/CVE-2025-22371 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This… Critical Network Exploitable Mon, 14 Apr 2025 15:32:49 GMT https://vulnogram.org/CVE-2025-22373 https://vulnogram.org/CVE-2025-22373 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML and alternation of CSS Styles This… High Network Exploitable Mon, 14 Apr 2025 15:32:49 GMT https://vulnogram.org/CVE-2025-22372 https://vulnogram.org/CVE-2025-22372 Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passw… Critical Network Exploitable Mon, 14 Apr 2025 15:32:49 GMT https://vulnogram.org/CVE-2025-22374 https://vulnogram.org/CVE-2025-22374 A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1.1.3. This vulnerability has been patched in versions after 1.1.3. Leaving this vulnerabilit… Medium Thu, 10 Apr 2025 11:02:47 GMT https://vulnogram.org/CVE-2025-22375 https://vulnogram.org/CVE-2025-22375 An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session without any credentials. This vulnerability has been patched in versions later than 9.5 and… Critical Network Exploitable Thu, 10 Apr 2025 11:02:46 GMT https://vulnogram.org/CVE-2025-22369 https://vulnogram.org/CVE-2025-22369 The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS. High Tue, 11 Mar 2025 13:40:24 GMT https://vulnogram.org/CVE-2025-22366 https://vulnogram.org/CVE-2025-22366 The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS. High Tue, 11 Mar 2025 13:40:23 GMT https://vulnogram.org/CVE-2025-22370 https://vulnogram.org/CVE-2025-22370 Many fields for the web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to execute arbitrary SQL commands because the values are insufficiently neutralized. Medium Tue, 11 Mar 2025 13:40:22 GMT https://vulnogram.org/CVE-2025-22368 https://vulnogram.org/CVE-2025-22368 The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS. High Tue, 11 Mar 2025 13:40:22 GMT https://vulnogram.org/CVE-2025-22367 https://vulnogram.org/CVE-2025-22367 The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS. High Tue, 11 Mar 2025 13:40:21 GMT https://vulnogram.org/CVE-2024-43651 https://vulnogram.org/CVE-2024-43651 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC models before version 241207101 Likelihood: Moderate – The <redacted> b… Critical Thu, 09 Jan 2025 07:56:47 GMT https://vulnogram.org/CVE-2024-43658 https://vulnogram.org/CVE-2024-43658 Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmware for AC model before firmware version 25010801. Likelihood: High, but requires authenticati… High Thu, 09 Jan 2025 07:56:47 GMT https://vulnogram.org/CVE-2024-43654 https://vulnogram.org/CVE-2024-43654 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injection as root This issue affects all Iocharger AC EV charger models on a firmware version befo… Critical Thu, 09 Jan 2025 07:56:47 GMT https://vulnogram.org/CVE-2024-43649 https://vulnogram.org/CVE-2024-43649 Authenticated command injection in the filename of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a comm… Critical Thu, 09 Jan 2025 07:56:46 GMT https://vulnogram.org/CVE-2024-43660 https://vulnogram.org/CVE-2024-43660 The CGI script <redacted>.sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High, but credentials required. Impact: Critical – The script can be used… High Network Exploitable Thu, 09 Jan 2025 07:56:46 GMT https://vulnogram.org/CVE-2024-43653 https://vulnogram.org/CVE-2024-43653 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: Moderate – The <red… Critical Thu, 09 Jan 2025 07:56:46 GMT https://vulnogram.org/CVE-2024-43661 https://vulnogram.org/CVE-2024-43661 The <redacted>.so library, which is used by <redacted>, is vulnerable to a buffer overflow in the code that handles the deletion of certificates. This buffer overflow can be triggered by providing a long file path to the <redacted> action of the <red… Critical Network Exploitable Thu, 09 Jan 2025 07:56:46 GMT https://vulnogram.org/CVE-2024-43652 https://vulnogram.org/CVE-2024-43652 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701 Likelihood: Moderate – The <reda… Critical Thu, 09 Jan 2025 07:56:46 GMT