Read the docs

Synchroweb

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Synchroweb records in CISA KEV

No Synchroweb vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Kiwire 3 records LOW Synconnect 1 record LOW

Records

3 records in Kiwire · all components

TI-2025-10251 CVE-2025-11189 · GHSA-g6jq-5hv4-7vjf

Cross-site scripting in Synchroweb Kiwire

Priority LOW 38

The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00385 Published 2025-10-10 No fix listed CWE-79
TI-2025-10250 CVE-2025-11188 · GHSA-5mxh-q367-rc3m

SQL injection in Synchroweb Kiwire

Priority LOW 38

The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding database.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00288 Published 2025-10-10 No fix listed CWE-89
TI-2025-10252 CVE-2025-11190 · GHSA-6425-32p4-2c56

Link following in Synchroweb Kiwire

Priority LOW 24

The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00312 Published 2025-10-10 No fix listed CWE-59
Open these records in search →