Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Sep 2, 2025E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password.CVE-2025-6519 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Critical 9.3
E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned.CVE-2025-52550 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191High 8.6
E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot.CVE-2025-52549 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Critical 9.2
E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist butCVE-2025-52548 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Medium 6.9
E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation.CVE-2025-52547 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191High 8.7
E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files.CVE-2025-52546 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Medium 5.1
E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes forCVE-2025-52545 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191High 7.7
E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files.CVE-2025-52544 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191High 8.8
E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication.CVE-2025-52543 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Medium 5.3
E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.