CentralSquare records
6 published records for vendor CentralSquare.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-288 Authentication Bypass Using an Alternate Path or Channel1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
- CWE-862 Missing Authorization1
The weakness classes this vendor ships most often: where to look.
CWEAll records
6 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
39Monitor | CVE-2025-64281No exploit | An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credencentralsquare · community development · CWE-288 | Critical9.8 | 0.4%Nov 12, 2025 |
39Monitor | CVE-2025-64280No exploit | A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.centralsquare · community development · CWE-89 | Critical9.8 | 0.3%Nov 12, 2025 |
37Monitor | CVE-2025-29980No exploit | Blind SQL Injection vulnerability in eTRAKiT.Netcentralsquare · etrakit.net · CWE-89 | Critical9.3 | 0.5%Mar 20, 2025 |
34Monitor | CVE-2024-45241Proof of concept | A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated atCWE-22 | High7.5 | 13.6%Aug 26, 2024 |
24Monitor | CVE-2025-59491No exploit | Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.centralsquare · community development · CWE-79 | Medium6.1 | 0.2%Nov 12, 2025 |
17Monitor | CVE-2023-40362Proof of concept | An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023.centralsquare · click2gov building permit · CWE-862 | Medium4.3 | 0.6%Jan 12, 2024 |
- CVE-2025-6428139Monitor
An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin creden
CriticalCVSS 9.8No exploitEPSS 0%centralsquare · community developmentNov 12, 2025
- CVE-2025-6428039Monitor
A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.
CriticalCVSS 9.8No exploitEPSS 0%centralsquare · community developmentNov 12, 2025
- CVE-2025-2998037Monitor
Blind SQL Injection vulnerability in eTRAKiT.Net
CriticalCVSS 9.3No exploitEPSS 0%centralsquare · etrakit.netMar 20, 2025
- CVE-2024-4524134Monitor
A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated at
HighCVSS 7.5Proof of conceptEPSS 13%Aug 26, 2024
- CVE-2025-5949124Monitor
Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.
MediumCVSS 6.1No exploitEPSS 0%centralsquare · community developmentNov 12, 2025
- CVE-2023-4036217Monitor
An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023.
MediumCVSS 4.3Proof of conceptEPSS 0%centralsquare · click2gov building permitJan 12, 2024