Com.ritense.valtimo vulnerabilities

Products

• Web 29

Newest

• com.ritense.valtimo web, valtimo-platform valtimo +1 more Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer CVE-2026-44516 Fix available 7.6 HighMay 11, 2026
• com.ritense.valtimo case, contract, document +1 more +3 more Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users CVE-2026-42555 Fix available 9.1 CriticalMay 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole has a Stored HTML Injection in queries.js CVE-2026-33405 3.1 LowApril 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole has a Stored HTML attribute injection CVE-2026-33406 5.4 MediumApril 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard CVE-2026-33404 3.4 LowApril 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole has a Reflected XSS / HTML injection in taillog.js CVE-2026-33403 6.1 MediumApril 6, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Web Interface has a Command Injection Vulnerability CVE-2026-33765 8.9 HighMarch 27, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table CVE-2026-26953 5.4 MediumFebruary 19, 2026
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute CVE-2026-26952 5.4 MediumFebruary 19, 2026
• com.ritense.valtimo web Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CVE-2025-55064 4.8 MediumDecember 29, 2025
• com.ritense.valtimo web Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CVE-2025-55063 4.8 MediumDecember 29, 2025
• com.ritense.valtimo web Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CVE-2025-55062 4.8 MediumDecember 29, 2025
• com.ritense.valtimo web Priority - CWE-434 Unrestricted Upload of File with Dangerous Type CVE-2025-55061 8.8 HighDecember 29, 2025
• com.ritense.valtimo web Priority - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CVE-2025-55060 6.1 MediumDecember 29, 2025
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection CVE-2025-59151 8.2 HighOctober 27, 2025
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page CVE-2025-53533 Public exploit 5.1 MediumOctober 27, 2025
• com.ritense.valtimo web, pi-hole web interface +1 more Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) CVE-2025-32785 2.0 LowOctober 27, 2025
• centreon web Second order SQL injection available to user with low privilege CVE-2025-6791 8.8 HighAugust 22, 2025
• centreon web User with high privileges is able to introduce a SQLi using the Meta Service indicator page CVE-2025-4650 7.2 HighAugust 22, 2025
• cesiumlab web CesiumLab Web lodmodels sql injection CVE-2025-8744 6.9 MediumAugust 8, 2025
• com.ritense.valtimo web Engeman Web Password Recovery RecoveryPass sql injection CVE-2025-8220 Public exploit 6.9 MediumJuly 27, 2025
• com.ritense.valtimo web, pi-hole +1 more Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution CVE-2025-34087 Public exploit 9.0 CriticalJuly 3, 2025
• centreon web ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. CVE-2025-4649 4.9 MediumMay 13, 2025
• centreon web A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request. CVE-2025-4648 8.4 HighMay 13, 2025
• centreon web A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG CVE-2025-4647 8.4 HighMay 13, 2025
• centreon web A high privilege user is able to create and use a valid admin API token in centreon-web CVE-2025-4646 7.2 HighMay 13, 2025
• com.ritense.valtimo web, graphite project graphite +1 more Graphite Web Absolute Time Range cross site scripting CVE-2022-4730 Fix available 3.5 LowDecember 24, 2022
• com.ritense.valtimo web, graphite project graphite +1 more Graphite Web Template Name cross site scripting CVE-2022-4729 Fix available 3.5 LowDecember 24, 2022
• com.ritense.valtimo web, graphite project graphite +1 more Graphite Web Cookie cross site scripting CVE-2022-4728 Fix available 3.5 LowDecember 24, 2022
• com.ritense.valtimo web uTorrent Web HTTP RPC Server privileges management CVE-2018-25040 6.3 MediumJune 17, 2022