https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-34266.htmlhttps://patchthecve.com/cve/CVE-2025-34266.htmlThu, 15 Oct 2026 21:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/addins/menus endpoint. When an authenticated user adds or edits an AddIns menu entry, the label and path values are stored in plugin configuration data and latehttps://patchthecve.com/cve/CVE-2025-34265.htmlhttps://patchthecve.com/cve/CVE-2025-34265.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an authenticated user creates or updates a rule for an agent, the rule fields min, max, and unit are stored and later rendered in rule listings orhttps://patchthecve.com/cve/CVE-2025-34264.htmlhttps://patchthecve.com/cve/CVE-2025-34264.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint. When an authenticated user adds or edits Software Watchdog process rules for an agent, the monitored process name is stored in the settings array and https://patchthecve.com/cve/CVE-2025-34263.htmlhttps://patchthecve.com/cve/CVE-2025-34263.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds or edits a dashboard entry, the label and path values are stored in plugin configuration data and lathttps://patchthecve.com/cve/CVE-2025-34262.htmlhttps://patchthecve.com/cve/CVE-2025-34262.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agent_id} endpoint. When an authenticated user renames a device, the new_name value is stored and later rendered in device listings or detail views without prophttps://patchthecve.com/cve/CVE-2025-34261.htmlhttps://patchthecve.com/cve/CVE-2025-34261.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint. When an authenticated user creates a device group, the name and description values are stored and later rendered in device group listings without prophttps://patchthecve.com/cve/CVE-2025-34260.htmlhttps://patchthecve.com/cve/CVE-2025-34260.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint. When an authenticated user adds a schedule to an existing task, the schedule name is stored and later rendered in schedule listings without HTML sanhttps://patchthecve.com/cve/CVE-2025-34259.htmlhttps://patchthecve.com/cve/CVE-2025-34259.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When an authenticated user creates a map entry, the name parameter is stored and later rendered in the map list UI without HTML sanitzation. An ahttps://patchthecve.com/cve/CVE-2025-34258.htmlhttps://patchthecve.com/cve/CVE-2025-34258.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint. When an authenticated user adds an area to a map entry, the name parameter is stored and later rendered in the map list without HTML sanitization. Anhttps://patchthecve.com/cve/CVE-2025-34257.htmlhttps://patchthecve.com/cve/CVE-2025-34257.htmlFri, 25 Sep 2026 23:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the defined_name value is stored and later rendered in the Overview page without HTML sanitization. An atthttps://patchthecve.com/cve/CVE-2025-34256.htmlhttps://patchthecve.com/cve/CVE-2025-34256.htmlWed, 17 Jun 2026 09:13:45 +0000CRITICAL 9.8: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote un