Vulnerabilidades de Sunbird
CVEs publicadas que afetam produtos de Sunbird: 9 registro(s), com severidade, exploração e correções.
CVE-2025-70027
Alta · 7.5
CWE-918 11/03/2026
Server-Side Request Forgery (SSRF) em Sunbird Sunbirded-portal
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive information
CVE-2025-70028
Alta · 7.5
CWE-22 09/03/2026
Path Traversal em Sunbird Sunbirded-portal
An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70031
Alta · 8.8
CWE-352 09/03/2026
Cross-Site Request Forgery (CSRF) em Sunbird Sunbirded-portal
An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70030
Alta · 7.5
CWE-1333 09/03/2026
Inefficient Regular Expression Complexity (ReDoS) em Sunbird Sunbirded-portal
An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70032
Média · 6.1
CWE-601 09/03/2026
Open Redirect em Sunbird Sunbirded-portal
An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70033
Média · 5.4
CWE-79 09/03/2026
Cross-site Scripting (XSS) em Sunbird Sunbirded-portal
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
CVE-2025-70029
Alta · 7.5
CWE-295 11/02/2026
Improper Certificate Validation em Sunbird Sunbirded-portal
An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in HTTP request options
CVE-2025-66238
Alta · 7.2
CWE-288 04/12/2025
Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel
DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.
CVE-2025-66237
Média · 6.7
CWE-798 04/12/2025
Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials
DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.