Threat database

CVE-2026-95102 is a critical vulnerability in Monta's monta.app where WebSocket endpoints lack proper authentication. This allows attackers to impersonate charging stations, potentially gaining unauthorized access to sensitive data and performing unauthorized actions. The absence of authentication can lead to privilege escalation and compromise the system's security.

CVE-2026-97363 is a vulnerability in the Monta monta.app WebSocket API where there are no restrictions on the number of authentication requests. This lack of rate limiting can enable attackers to perform denial-of-service or brute-force attacks. The vulnerability has a high severity rating with a CVSS score of 7.5, primarily impacting availability. No affected versions or patches are explicitly stated in the available data.

CVE-2026-97212 is a vulnerability in Monta's monta.app where the WebSocket backend uses predictable session identifiers by allowing multiple endpoints to connect using the same charging station identifier. This flaw can enable unauthorized users to impersonate others or cause denial-of-service by flooding the backend with valid session requests. The vulnerability has a high severity rating with a CVSS score of 7.3.

CVE-2026-93474 is a medium severity vulnerability in Monta's monta.app where charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure could allow unauthorized parties to access or misuse these identifiers. The vulnerability has a CVSS score of 6.5, indicating a moderate risk with low attack complexity and no required privileges or user interaction.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in montashov 4 author cheer up donate 4-author-cheer-up-donate allows Reflected XSS.This issue affects 4 author cheer up donate: from n/a through <= 1.3.