Vulnerabilities

12 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos

ShowKEV only Public PoC CVSS ≥ 9 CVSS ≥ 7 EPSS ≥ 10%EPSS ≥ 50%Window24h 7d 30d 90d All

StackAll WordPress E-commerce Drupal Joomla npm pip Maven Go Packagist RubyGems NuGet

Sortpublished epss cvss KEV date updated vendor: sunbird ✕

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2025-70027	An issue pertaining to CWE-918: An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive information NVD description · AI analysis pending	7.5	<1%		sunbird sunbirded-portal	—	Mar 11, 2026
CVE-2025-70031 +4 in the same advisory: …70028 …70030 …70032 …70033	An issue pertaining to CWE-352: An issue pertaining to CWE-352: Cross-Site Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. NVD description · AI analysis pending	8.8 group max	<1%		sunbird sunbirded-portal	—	Mar 9, 2026
CVE-2025-70029	An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in HTTP request options NVD description · AI analysis pending	7.5	<1%		sunbird sunbirded-portal	—	Feb 11, 2026
CVE-2025-55703	An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays without proper input validation. This can allow attackers to manipulate SQL queries. This has been addressed in Power IQ version 9.2.1, where the API call code was updated to ensure safe handling of input values. NVD description · AI analysis pending	3.3	<1%		sunbirddcim power iq	—	Dec 15, 2025
CVE-2024-37774 +3 in the same advisory: …37775 …37776 …37773	A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user to perform sensitive requests in some admin screens. NVD description · AI analysis pending	8.0 group max	<1%		sunbirddcim dctrack	—	Dec 16, 2024