Sunbird vulnerabilities
Published CVEs affecting Sunbird products: 9 record(s), with severity, exploitation and fixes.
CVE-2025-70027
High · 7.5
CWE-918 Mar 11, 2026
Server-Side Request Forgery (SSRF) in Sunbird Sunbirded-portal
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive information
CVE-2025-70028
High · 7.5
CWE-22 Mar 9, 2026
Path Traversal in Sunbird Sunbirded-portal
An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70031
High · 8.8
CWE-352 Mar 9, 2026
Cross-Site Request Forgery (CSRF) in Sunbird Sunbirded-portal
An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70030
High · 7.5
CWE-1333 Mar 9, 2026
Inefficient Regular Expression Complexity (ReDoS) in Sunbird Sunbirded-portal
An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70032
Medium · 6.1
CWE-601 Mar 9, 2026
Open Redirect in Sunbird Sunbirded-portal
An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70033
Medium · 5.4
CWE-79 Mar 9, 2026
Cross-site Scripting (XSS) in Sunbird Sunbirded-portal
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70029
High · 7.5
CWE-295 Feb 11, 2026
Improper Certificate Validation in Sunbird Sunbirded-portal
An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in HTTP request options
CVE-2025-66238
High · 7.2
CWE-288 Dec 4, 2025
Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel
DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.
CVE-2025-66237
Medium · 6.7
CWE-798 Dec 4, 2025
Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials
DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.