Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:35:17 +0000 CVE-2022-45137 — WAGO: Reflective Cross-Site Scripting https://cve.radiocsirt.org/vuln/cve-2022-45137 <p><strong>Affected:</strong> WAGO Compact Controller CC100 (751-9301), WAGO Edge Controller (752-8303/8000-002), WAGO PFC100 (750-81xx/xxx-xxx), WAGO PFC200 (750-82xx/xxx-xxx), WAGO Touch Panel 600 Advanced Line (762-5xxx), WAGO Touch Panel 600 Marine Line (762-6xxx), WAGO Touch Panel 600 Standard Line (762-4xxx)</p> <p>The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.</p> <p><strong>Affected:</strong> WAGO Compact Controller CC100 (751-9301), WAGO Edge Controller (752-8303/8000-002), WAGO PFC100 (750-81xx/xxx-xxx), WAGO PFC200 (750-82xx/xxx-xxx), WAGO Touch Panel 600 Advanced Line (762-5xxx), WAGO Touch Panel 600 Marine Line (762-6xxx), WAGO Touch Panel 600 Standard Line (762-4xxx)</p> <p>The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.</p> https://cve.radiocsirt.org/vuln/cve-2022-45137 VDE-2022-060 — WAGO: Multiple vulnerabilities in web-based management of multiple products https://cve.radiocsirt.org/vuln/vde-2022-060 <p>The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. The configuration backend can in some cases be used without authentication and to write data with root privileges. Additionally, the web-based management suffers a CORS misconfiguration and allows reflected XSS (Cross-Site Scripting) attacks.</p> <p>The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. The configuration backend can in some cases be used without authentication and to write data with root privileges. Additionally, the web-based management suffers a CORS misconfiguration and allows reflected XSS (Cross-Site Scripting) attacks.</p> https://cve.radiocsirt.org/vuln/vde-2022-060