r1bbit records
10 published records for vendor r1bbit.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 50%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')3
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')3
- CWE-266 Incorrect Privilege Assignment1
- CWE-284 Improper Access Control1
- CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory1
- CWE-610 Externally Controlled Reference to a Resource in Another Sphere1
The weakness classes this vendor ships most often: where to look.
CWEAll records
10 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
29Monitor | CVE-2025-25585No exploit | Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitr1bbit · yimioa · CWE-284 | High7.3 | — | 0.2% | Mar 18, 2025 |
27Monitor | CVE-2025-1226No exploit | ywoa setup.jsp improper authorizationr1bbit · yimioa · CWE-266 | Medium6.9 | — | 0.8% | Feb 12, 2025 |
24Monitor | CVE-2025-25590No exploit | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml.r1bbit · yimioa · CWE-89 | Medium6.1 | — | 0.1% | Mar 18, 2025 |
24Monitor | CVE-2025-25580No exploit | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml.r1bbit · yimioa · CWE-89 | Medium6.1 | — | 0.1% | Mar 18, 2025 |
24Monitor | CVE-2025-25582No exploit | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xr1bbit · yimioa · CWE-89 | Medium6.1 | — | 0.1% | Mar 18, 2025 |
21Monitor | CVE-2025-1216No exploit | ywoa OaNoticeMapper.xml selectNoticeList sql injectionr1bbit · yimioa · CWE-74 | Medium5.3 | — | 0.5% | Feb 12, 2025 |
21Monitor | CVE-2025-1227No exploit | ywoa AddressDao.xml selectList sql injectionr1bbit · yimioa · CWE-74 | Medium5.3 | — | 0.5% | Feb 12, 2025 |
21Monitor | CVE-2025-1224No exploit | ywoa UserMapper.xml listNameBySql sql injectionr1bbit · yimioa · CWE-74 | Medium5.3 | — | 0.4% | Feb 12, 2025 |
21Monitor | CVE-2025-1225No exploit | ywoa WXCallBack Interface XMLParse.java extract xml external entity referencer1bbit · yimioa · CWE-610 | Medium5.3 | — | 0.3% | Feb 12, 2025 |
16Monitor | CVE-2025-25586No exploit | yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.r1bbit · yimioa · CWE-538 | Medium4.2 | — | 0.1% | Mar 18, 2025 |
- CVE-2025-2558529Monitor
Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbit
HighCVSS 7.3No exploitEPSS 0%r1bbit · yimioaMar 18, 2025
- CVE-2025-122627Monitor
ywoa setup.jsp improper authorization
MediumCVSS 6.9No exploitEPSS 0%r1bbit · yimioaFeb 12, 2025
- CVE-2025-2559024Monitor
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml.
MediumCVSS 6.1No exploitEPSS 0%r1bbit · yimioaMar 18, 2025
- CVE-2025-2558024Monitor
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml.
MediumCVSS 6.1No exploitEPSS 0%r1bbit · yimioaMar 18, 2025
- CVE-2025-2558224Monitor
yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.x
MediumCVSS 6.1No exploitEPSS 0%r1bbit · yimioaMar 18, 2025
- CVE-2025-121621Monitor
ywoa OaNoticeMapper.xml selectNoticeList sql injection
MediumCVSS 5.3No exploitEPSS 0%r1bbit · yimioaFeb 12, 2025
- CVE-2025-122721Monitor
ywoa AddressDao.xml selectList sql injection
MediumCVSS 5.3No exploitEPSS 0%r1bbit · yimioaFeb 12, 2025
- CVE-2025-122421Monitor
ywoa UserMapper.xml listNameBySql sql injection
MediumCVSS 5.3No exploitEPSS 0%r1bbit · yimioaFeb 12, 2025
- CVE-2025-122521Monitor
ywoa WXCallBack Interface XMLParse.java extract xml external entity reference
MediumCVSS 5.3No exploitEPSS 0%r1bbit · yimioaFeb 12, 2025
- CVE-2025-2558616Monitor
yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.
MediumCVSS 4.2No exploitEPSS 0%r1bbit · yimioaMar 18, 2025