Synchroweb vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Synchroweb products: 3 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2025-11190 Medium · 5.4 CWE-59 Oct 10, 2025

The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.

CVE-2025-11189 High · 7.3 CWE-79 Oct 10, 2025

The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.

CVE-2025-11188 High · 7.3 CWE-89 Oct 10, 2025

The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding database.