Vulnerabilities

TI-2025-37864 CVE-2025-60938 · GHSA-765w-986x-7c7p

Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature…

HIGH 68

Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00609 Published 2025-10-24 No fix listed CWE-20

TI-2025-37863 CVE-2025-60936 · GHSA-r2f6-mm34-mhfx

Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism.

MEDIUM 60

Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00195 Published 2025-10-24 No fix listed CWE-79

TI-2025-16814 CVE-2025-22992 · GHSA-hgg2-xfw8-rh3r

A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms…

HIGH 82

A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project >= 11.6.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00533 Published 2025-02-06 No fix listed CWE-89

TI-2021-08395 CVE-2021-26716 · GHSA-gr6q-jf82-h2r3

Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.

LOW 29

Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00791 Published 2021-02-21 No fix listed CWE-79

TI-2019-15949 CVE-2019-1010008 · GHSA-2v43-7wf7-4934

Cross-site scripting in OpenEnergyMonitor Project Emoncms

LOW 26

OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS).

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0088 Published 2019-07-15 No fix listed CWE-79

TI-2017-03879 CVE-2017-5964 · GHSA-5gm9-446r-2x5q

An issue was discovered in Emoncms through 9.8.0.

LOW 29

An issue was discovered in Emoncms through 9.8.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00918 Published 2017-02-12 No fix listed CWE-79

Vulnerabilities

Filters

Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature…

Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism.

A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms…

Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.

Cross-site scripting in OpenEnergyMonitor Project Emoncms

An issue was discovered in Emoncms through 9.8.0.