PatchTheCVE: cloud portalhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-31950: An unauthenticated attacker can obtain EV charger energy consumption information of other users.https://patchthecve.com/cve/CVE-2025-31950.htmlhttps://patchthecve.com/cve/CVE-2025-31950.htmlWed, 17 Jun 2026 09:11:13 +0000MEDIUM 5.3: An unauthenticated attacker can obtain EV charger energy consumption information of other users.CVE-2025-31945: An unauthenticated attacker can obtain other users' charger information.https://patchthecve.com/cve/CVE-2025-31945.htmlhttps://patchthecve.com/cve/CVE-2025-31945.htmlWed, 17 Jun 2026 09:11:12 +0000MEDIUM 5.3: An unauthenticated attacker can obtain other users' charger information.CVE-2025-31654: An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms")https://patchthecve.com/cve/CVE-2025-31654.htmlhttps://patchthecve.com/cve/CVE-2025-31654.htmlWed, 17 Jun 2026 09:10:44 +0000MEDIUM 5.3: An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").CVE-2025-31360: Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.https://patchthecve.com/cve/CVE-2025-31360.htmlhttps://patchthecve.com/cve/CVE-2025-31360.htmlWed, 17 Jun 2026 09:10:17 +0000MEDIUM 6.5: Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.CVE-2025-31147: Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.https://patchthecve.com/cve/CVE-2025-31147.htmlhttps://patchthecve.com/cve/CVE-2025-31147.htmlWed, 17 Jun 2026 09:09:56 +0000MEDIUM 5.3: Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-30512: Unauthenticated attackers can send configuration settings to device and possible perform physical actions remohttps://patchthecve.com/cve/CVE-2025-30512.htmlhttps://patchthecve.com/cve/CVE-2025-30512.htmlWed, 17 Jun 2026 09:08:50 +0000MEDIUM 6.5: Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).CVE-2025-30510: An attacker can upload an arbitrary file instead of a plant image.https://patchthecve.com/cve/CVE-2025-30510.htmlhttps://patchthecve.com/cve/CVE-2025-30510.htmlWed, 17 Jun 2026 09:08:50 +0000CRITICAL 9.8: An attacker can upload an arbitrary file instead of a plant image.CVE-2025-30257: Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.https://patchthecve.com/cve/CVE-2025-30257.htmlhttps://patchthecve.com/cve/CVE-2025-30257.htmlWed, 17 Jun 2026 09:08:24 +0000MEDIUM 5.3: Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.CVE-2025-27929: Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.https://patchthecve.com/cve/CVE-2025-27929.htmlhttps://patchthecve.com/cve/CVE-2025-27929.htmlWed, 17 Jun 2026 09:04:24 +0000MEDIUM 5.3: Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.CVE-2025-27927: An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotehttps://patchthecve.com/cve/CVE-2025-27927.htmlhttps://patchthecve.com/cve/CVE-2025-27927.htmlWed, 17 Jun 2026 09:04:24 +0000MEDIUM 5.3: An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.CVE-2025-27719: Unauthenticated attackers can query an API endpoint and get device details.https://patchthecve.com/cve/CVE-2025-27719.htmlhttps://patchthecve.com/cve/CVE-2025-27719.htmlWed, 17 Jun 2026 09:04:07 +0000MEDIUM 5.3: Unauthenticated attackers can query an API endpoint and get device details.CVE-2025-27575: An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the chargehttps://patchthecve.com/cve/CVE-2025-27575.htmlhttps://patchthecve.com/cve/CVE-2025-27575.htmlWed, 17 Jun 2026 09:03:49 +0000MEDIUM 5.3: An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.CVE-2025-27565: An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.https://patchthecve.com/cve/CVE-2025-27565.htmlhttps://patchthecve.com/cve/CVE-2025-27565.htmlWed, 17 Jun 2026 09:03:48 +0000MEDIUM 5.3: An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.CVE-2025-27561: Unauthenticated attackers can rename "rooms" of arbitrary users.https://patchthecve.com/cve/CVE-2025-27561.htmlhttps://patchthecve.com/cve/CVE-2025-27561.htmlWed, 17 Jun 2026 09:03:48 +0000MEDIUM 5.3: Unauthenticated attackers can rename "rooms" of arbitrary users.CVE-2025-26857: Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).https://patchthecve.com/cve/CVE-2025-26857.htmlhttps://patchthecve.com/cve/CVE-2025-26857.htmlWed, 17 Jun 2026 09:02:29 +0000MEDIUM 5.3: Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).CVE-2025-25276: An unauthenticated attacker can hijack other users' devices and potentially control them.https://patchthecve.com/cve/CVE-2025-25276.htmlhttps://patchthecve.com/cve/CVE-2025-25276.htmlWed, 17 Jun 2026 09:00:35 +0000MEDIUM 5.3: An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-24850: An attacker can export other users' plant information.https://patchthecve.com/cve/CVE-2025-24850.htmlhttps://patchthecve.com/cve/CVE-2025-24850.htmlWed, 17 Jun 2026 08:59:42 +0000MEDIUM 5.3: An attacker can export other users' plant information.CVE-2025-24315: Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrahttps://patchthecve.com/cve/CVE-2025-24315.htmlhttps://patchthecve.com/cve/CVE-2025-24315.htmlWed, 17 Jun 2026 08:58:32 +0000MEDIUM 5.3: Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).CVE-2025-24297: Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personahttps://patchthecve.com/cve/CVE-2025-24297.htmlhttps://patchthecve.com/cve/CVE-2025-24297.htmlWed, 17 Jun 2026 08:58:30 +0000CRITICAL 9.8: Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.CVE-2025-31949: An authenticated attacker can obtain any plant name by knowing the plant ID.https://patchthecve.com/cve/CVE-2025-31949.htmlhttps://patchthecve.com/cve/CVE-2025-31949.htmlWed, 17 Jun 2026 09:11:13 +0000MEDIUM 5.3: An authenticated attacker can obtain any plant name by knowing the plant ID.CVE-2025-31941: An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.https://patchthecve.com/cve/CVE-2025-31941.htmlhttps://patchthecve.com/cve/CVE-2025-31941.htmlWed, 17 Jun 2026 09:11:12 +0000MEDIUM 5.3: An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.CVE-2025-31933: An unauthenticated attacker can check the existence of usernames in the system by querying an API.https://patchthecve.com/cve/CVE-2025-31933.htmlhttps://patchthecve.com/cve/CVE-2025-31933.htmlWed, 17 Jun 2026 09:11:12 +0000MEDIUM 5.3: An unauthenticated attacker can check the existence of usernames in the system by querying an API.CVE-2025-31357: An unauthenticated attacker can obtain a user's plant list by knowing the username.https://patchthecve.com/cve/CVE-2025-31357.htmlhttps://patchthecve.com/cve/CVE-2025-31357.htmlWed, 17 Jun 2026 09:10:17 +0000MEDIUM 5.3: An unauthenticated attacker can obtain a user's plant list by knowing the username.CVE-2025-30514: Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "schttps://patchthecve.com/cve/CVE-2025-30514.htmlhttps://patchthecve.com/cve/CVE-2025-30514.htmlWed, 17 Jun 2026 09:08:50 +0000MEDIUM 5.3: Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").CVE-2025-30511: An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value whttps://patchthecve.com/cve/CVE-2025-30511.htmlhttps://patchthecve.com/cve/CVE-2025-30511.htmlWed, 17 Jun 2026 09:08:50 +0000HIGH 8.8: An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.CVE-2025-30254: An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.https://patchthecve.com/cve/CVE-2025-30254.htmlhttps://patchthecve.com/cve/CVE-2025-30254.htmlWed, 17 Jun 2026 09:08:24 +0000MEDIUM 5.3: An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.CVE-2025-27939: An attacker can change registered email addresses of other users and take over arbitrary accounts.https://patchthecve.com/cve/CVE-2025-27939.htmlhttps://patchthecve.com/cve/CVE-2025-27939.htmlWed, 17 Jun 2026 09:04:25 +0000HIGH 7.5: An attacker can change registered email addresses of other users and take over arbitrary accounts.CVE-2025-27938: Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rohttps://patchthecve.com/cve/CVE-2025-27938.htmlhttps://patchthecve.com/cve/CVE-2025-27938.htmlWed, 17 Jun 2026 09:04:25 +0000MEDIUM 5.3: Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").CVE-2025-27568: An unauthenticated attacker can get users' emails by knowing usernameshttps://patchthecve.com/cve/CVE-2025-27568.htmlhttps://patchthecve.com/cve/CVE-2025-27568.htmlWed, 17 Jun 2026 09:03:49 +0000MEDIUM 5.3: An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.CVE-2025-24487: An unauthenticated attacker can infer the existence of usernames in the system by querying an API.https://patchthecve.com/cve/CVE-2025-24487.htmlhttps://patchthecve.com/cve/CVE-2025-24487.htmlWed, 17 Jun 2026 08:59:06 +0000MEDIUM 5.3: An unauthenticated attacker can infer the existence of usernames in the system by querying an API.