CVE-2025-9914

all versions

The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker

4.3MEDIUM

CVE-2025-9913

all versions

JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to sess

4.5MEDIUM

CVE-2025-58591

all versions

A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the ap

6.5MEDIUM

CVE-2025-58590

<= 4.6.1

It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.

6.5MEDIUM

CVE-2025-58589

all versions

When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as

2.7LOW

CVE-2025-58587

all versions

The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time fram

6.5MEDIUM

CVE-2025-58586

all versions

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorr

5.3MEDIUM

CVE-2025-58585

all versions

Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gat

5.3MEDIUM

CVE-2025-58584

all versions

In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in v

5.3MEDIUM

CVE-2025-58579

all versions

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the applica

5.3MEDIUM

CVE-2025-49193

all versions

The application fails to implement several security headers. These headers help increase the overall security level of the web app

4.2MEDIUM

CVE-2025-49186

all versions

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, m

5.3MEDIUM

CVE-2025-49184

all versions

A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration

7.5HIGH