Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Sep 8, 2025Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface.CVE-2025-41708 · Other software · Bender · reported by info@cert.vde.comHigh 7.4
Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.CVE-2025-41682 · Other software · Bender · reported by info@cert.vde.comHigh 8.8
An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface.CVE-2021-34602 · Other software · Bender / ebee · reported by info@cert.vde.comHigh 8.8
In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials.CVE-2021-34601 · Other software · Bender / ebee · reported by info@cert.vde.comCritical 9.8
In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface.CVE-2021-34592 · Other software · Bender / ebee · reported by info@cert.vde.comHigh 8.8
In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation.CVE-2021-34591 · Other software · Bender / ebee · reported by info@cert.vde.comHigh 7.8
In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting.CVE-2021-34590 · Other software · Bender / ebee · reported by info@cert.vde.comMedium 5.4
In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak.CVE-2021-34589 · Other software · Bender / ebee · reported by info@cert.vde.comHigh 7.5
In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export.CVE-2021-34588 · Other software · Bender / ebee · reported by info@cert.vde.comHigh 8.6
In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 27, 2022In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash.CVE-2021-34587 · Other software · Bender / ebee · reported by info@cert.vde.comMedium 5.3
In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable.
- Product
- CC612
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.