CVE-2025-9495None▾ SunlitThe Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass log…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117554Medium· 4.3Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
CVE-2026-116605Medium· 5.3SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security
CVE-2026-110314Medium· 6.3WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
CVE-2025-66507High· 7.51Panel is an open-source, web-based control panel for Linux server management
CVE-2026-89205Medium· 6.3A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
CVE-2026-89206Medium· 6.3A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)