Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Mar 28, 2025SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server.CVE-2025-2865 · Other software · Arteche · reported by cve-coordination@incibe.esLow 2.4
SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker.
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is CVE-2025-2864 · Other software · Arteche · reported by cve-coordination@incibe.esLow 2
SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attackerCVE-2025-2863 · Other software · Arteche · reported by cve-coordination@incibe.esMedium 5.7
Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions.
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption.CVE-2025-2862 · Other software · Arteche · reported by cve-coordination@incibe.esMedium 6.9
SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol.CVE-2025-2861 · Other software · Arteche · reported by cve-coordination@incibe.esMedium 6.9
SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain them and log in legitimately.
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml fileCVE-2025-2860 · Other software · Arteche · reported by cve-coordination@incibe.esMedium 6.9
SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml file). In order to exploit this vulnerability, the attacker must know the path, regardless of the user's privileges on the website.
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the dCVE-2025-2859 · Other software · Arteche · reported by cve-coordination@incibe.esMedium 6.9
An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3.CVE-2025-2858 · Other software · Arteche · reported by cve-coordination@incibe.esHigh 8.5
Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restrictions and elevate privileges as a superuser.
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.