Approved changes feed: RSS · Atom
cpe:2.3:a:cs-technologies:evolution:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cs Technologies (0508cf2d-ae4e-5442-bed9-66964ba37af6) |
|---|---|
| Product | Evolution (a0debcc6-c67e-5181-b060-213bb8e359ca) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-91997 |
vulnerable | 2026-09-16 04:32:55.456415 |
evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
MEDIUM (5.3)
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.
Published: 2026-09-15T11:35:51.378Z
Updated: 2026-09-24T14:22:36.625Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29844 |
vulnerable | 2026-06-08 06:33:29.430358 |
Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions
CRITICAL (9.8)
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.
Published: 2024-04-14T23:48:26.802Z
Updated: 2024-09-25T22:37:13.799Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29843 |
vulnerable | 2026-06-08 06:33:29.429965 |
Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration
HIGH (7.5)
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels
Published: 2024-04-14T23:48:21.656Z
Updated: 2024-08-02T01:17:57.993Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29842 |
vulnerable | 2026-06-08 06:33:29.429453 |
Broken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values
HIGH (7.5)
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user
Published: 2024-04-14T23:48:17.195Z
Updated: 2024-08-02T01:17:57.926Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29841 |
vulnerable | 2026-06-08 06:33:29.429100 |
Broken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values
HIGH (7.5)
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS, allowing for an unauthenticated attacker to return the keys value of any user
Published: 2024-04-14T23:48:12.171Z
Updated: 2024-08-02T01:17:58.164Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29840 |
vulnerable | 2026-06-08 06:33:29.428663 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29839 |
vulnerable | 2026-06-08 06:33:29.428256 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29838 |
vulnerable | 2026-06-08 06:33:29.427800 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29837 |
vulnerable | 2026-06-08 06:33:29.427282 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29836 |
vulnerable | 2026-06-08 06:33:29.426762 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.