Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: joey-zhou Clear all filters
TI-2026-75409 CVE-2026-111623 · GHSA-g79m-4gpq-p8x3

Authentication bypass in Xiaozhi ESP32 server Java via OTA endpoint

Priority MEDIUM 61

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00465 Published 2026-10-16 No fix listed CWE-290
TI-2025-02966 CVE-2025-3382 · GHSA-pfr4-hcrh-5w35

joey-zhou xiaozhi-esp32-server-java update sql injection

Priority MEDIUM 57

A vulnerability has been found in joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00334 Published 2025-04-07 No fix listed CWE-74