Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2026-91997

evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cs-technologies Evolution-foundation
Products
Evolution Evolution-api
CVE-2022-50949

WordPress Plugin Videos sync PDF 1.7.4 Stored XSS

WordPress Plugin Videos sync PDF 1.7.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting unsanitized mov, pdf, mp4, webm, and ogg parameters. Attackers can inject payloads like autofocus onfocus event handlers through the plugin options panel to execute arbitrary JavaScript when administrators view or edit video settings.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
A-j-evolution Cs-technologies Wordpress
Products
Videos Sync Pdf Evolution Wordpress
CVE-2024-29844

Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions

Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Cs-technologies Cs Technologies
Products
Evolution Evolution Controller
CVE-2024-29843

Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cs-technologies
Products
Evolution
CVE-2024-29842

Broken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cs-technologies
Products
Evolution
CVE-2024-29840

Broken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field values

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cs-technologies
Products
Evolution
CVE-2024-29841

Broken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS, allowing for an unauthenticated attacker to return the keys value of any user

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cs-technologies
Products
Evolution
CVE-2024-29837

Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Cs-technologies
Products
Evolution
CVE-2024-29838

Unsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crash

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, allowing for an unauthenticated attacker to crash the controller software

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cs-technologies
Products
Evolution
CVE-2024-29836

Broken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeover

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Cs-technologies
Products
Evolution
CVE-2024-29839

Broken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cs-technologies
Products
Evolution