Vulnerabilidades de Evmapa
CVEs publicadas que afetam produtos de Evmapa: 3 registro(s), com severidade, exploração e correções.
CVE-2025-55705
Crítica · 9.8
CWE-613 22/01/2026
EVMAPA Insufficient Session Expiration
This vulnerability occurs when the system permits multiple simultaneous
connections to the backend using the same charging station ID. This can
result in unauthorized access, data inconsistency, or potential
manipulation of charging sessions. The lack of proper session management
and expiration control allows attackers to exploit this weakness by
reusing valid charging station IDs to establish multiple sessions
concurrently.
CVE-2025-54816
Crítica · 9.8
CWE-306 22/01/2026
EVMAPA Missing Authentication for Critical Function
This vulnerability occurs when a WebSocket endpoint does not enforce
proper authentication mechanisms, allowing unauthorized users to
establish connections. As a result, attackers can exploit this weakness
to gain unauthorized access to sensitive data or perform unauthorized
actions. Given that no authentication is required, this can lead to
privilege escalation and potentially compromise the security of the
entire system.
CVE-2025-53968
Alta · 7.5
CWE-307 22/01/2026
EVMAPA Improper Restriction of Excessive Authentication Attempts
This vulnerability arises because there are no limitations on the number
of authentication attempts a user can make. An attacker can exploit
this weakness by continuously sending authentication requests, leading
to a denial-of-service (DoS) condition. This can overwhelm the
authentication system, rendering it unavailable to legitimate users and
potentially causing service disruption. This can also allow attackers to
conduct brute-force attacks to gain unauthorized access.