synchroweb vulnerabilities

Products

• Kiwire 3
• synconnect 1

Latest synchroweb CVEs

Newest publication first

1. CVE-2025-11190 CVE-2025-11190

   Published 2025-10-10

   Medium·CVSS 5.4

   The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.

2. CVE-2025-11189 CVE-2025-11189

   Published 2025-10-10

   High·CVSS 7.3

   The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.

3. CVE-2025-11188 CVE-2025-11188

   Published 2025-10-10

   High·CVSS 7.3

   The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding database.

4. CVE-2013-2690 SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action.

   Published 2013-03-28

   High·CVSS 7.5 EPSS 2.5%

   SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.