Aggregates CVE and security vulnerability intelligence across all synchroweb-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Disclosed issues often relate to vendor risk sql injection, vendor risk cross-site scripting, and vendor risk path handling; exposure may include vendor impact file overwrite in vendor surface production workloads contexts.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-11190 | The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website. | [email protected] | 5.4 | 0.06% | 2025-10-10 | 2025-11-17 |
| CVE-2025-11189 | The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution. | [email protected] | 7.3 | 0.07% | 2025-10-10 | 2025-11-17 |
| CVE-2025-11188 | The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding database. | [email protected] | 7.3 | 0.02% | 2025-10-10 | 2025-11-14 |
| CVE-2013-2690 | SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action. | [email protected] | 7.5 | 2.17% | 2013-03-28 | 2026-04-29 |