Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Aug 28, 2025Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection.CVE-2025-51643 · Other software · Meitrack · reported by MITRELow 2.4
Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter
- Product
- T366l-g Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions.CVE-2020-17485 · Other software · Uffizio · reported by MITRECritical 9.8
A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse shell. An attacker could then run commands, browse system files, and browse local resources
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redireCVE-2020-17484 · Other software · Uffizio · reported by MITREMedium 6.1
An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devicesCVE-2020-17483 · Other software · Uffizio · reported by MITREHigh 7.5
An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have been deployed.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which acCVE-2022-34150 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govHigh 7.1
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” wCVE-2022-33944 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govMedium 6.5
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a userCVE-2022-2199 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govHigh 7.5
The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.CVE-2022-2141 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govCritical 9.8
SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password.CVE-2022-2107 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govCritical 9.8
The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.CVE-2021-32929 · Other software · Uffizio · reported by ics-cert@hq.dhs.govMedium 4.3
All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.CVE-2021-32927 · Other software · Uffizio · reported by ics-cert@hq.dhs.govHigh 7.1
An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2017Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS TrackerCVE-2017-5239 · Other software · Eview · reported by cve@rapid7.comHigh 7.5
Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle (MitM) listener.
- Product
- EV-07S GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcommunity.rapid7.com
Mar 27, 2017Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overCVE-2017-5238 · Other software · Eview · reported by cve@rapid7.comMedium 5.3
Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field.
- Product
- EV-07S GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcommunity.rapid7.com
Mar 27, 2017Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configCVE-2017-5237 · Other software · Eview · reported by cve@rapid7.comHigh 7.5
Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!"
- Product
- EV-07S GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcommunity.rapid7.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.