Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30

Export CSV
CVE-2025-30512

Growatt Cloud portal External Control of System or Configuration Setting

Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27938

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27939

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can change registered email addresses of other users and take over arbitrary accounts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30511

Growatt Cloud Applications Cross-site Scripting

An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-30514

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31950

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can obtain EV charger energy consumption information of other users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31654

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-31360

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-27568

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal
CVE-2025-24487

Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can infer the existence of usernames in the system by querying an API.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Growatt
Products
Cloud Portal