Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
44 results
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged)CVE-2025-26378 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged)CVE-2025-26377 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.1
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove users via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged)CVE-2025-26376 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to modify user data via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged)CVE-2025-26375 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create users with arbitrary privileges via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticatedCVE-2025-26374 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated CVE-2025-26373 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26372 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.1
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove users from groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26371 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add users to groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26370 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.1
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove privileges from user groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26369 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add privileges to user groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26368 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.1
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove user groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26367 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 4.3
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create arbitrary user groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26366 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable front panel authentication via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26365 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable front panel authentication via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26364 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable an authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26363 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable an authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26362 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26361 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.1
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an uCVE-2025-26360 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.3
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26359 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remoteCVE-2025-26358 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to modify system configuration via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker toCVE-2025-26357 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 4.9
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticatCVE-2025-26356 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.2
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker toCVE-2025-26355 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated reCVE-2025-26354 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.2
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensCVE-2025-26353 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 4.9
A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to dCVE-2025-26352 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to rCVE-2025-26351 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 4.9
A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenCVE-2025-26350 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 4.9
A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker tCVE-2025-26349 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.2
A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MCVE-2025-26348 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenCVE-2025-26347 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-FCVE-2025-26346 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenCVE-2025-26345 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unCVE-2025-26344 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attCVE-2025-26343 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.1
A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26342 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26341 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacCVE-2025-26340 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticCVE-2025-26339 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker tCVE-2025-1102 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker tCVE-2025-1101 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.3
A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to CVE-2025-1100 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to execute arbitrary code with root privileges via SSH.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2024An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 coCVE-2024-38944 · Other software · intelight · reported by MITRECritical 9.8
An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component.
- Product
- x_1l_traffic_controller_maxtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.