Vulnerabilities

TI-2026-22565 CVE-2026-28230

Improper access control in steve-community steve

LOW 25

SteVe is an open-source EV charging station management system.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00185 Published 2026-02-26 No fix listed CWE-284

TI-2024-30014 CVE-2024-44843 · GHSA-g2fr-wj73-rxrw

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass…

HIGH 68

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests.

CVSS 3.1MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00452 Published 2025-04-15 No fix listed CWE-287

TI-2024-14305 CVE-2024-21550 · GHSA-g97m-fwww-wqf3

Cross-site scripting in SteVe

LOW 27

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00399 Published 2024-08-12 Fixed in 3.5.1, 3.6.1 +1 CWE-79

TI-2024-16726 CVE-2024-25407 · GHSA-hg7g-ghrw-94pc

SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a…

HIGH 72

SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00562 Published 2024-02-13 No fix listed CWE-331

Vulnerabilities

Filters

Improper access control in steve-community steve

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass…

Cross-site scripting in SteVe

SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a…