Skip to content
OpenAdvisories

Product · joey-zhou

xiaozhi-esp32-server-java

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.6
    CVE-2026-111623

    Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance

    Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebS…

    joey-zhou xiaozhi-esp32-server-java
  • Medium 6.3
    CVE-2025-15135

    joey-zhou xiaozhi-esp32-server-java Cookie AuthenticationInterceptor.java tryAuthenticateWithCookies improper authentication

    A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file AuthenticationInterceptor.java of the component Cookie Handler. Executing manipulation can lead to improper aut…

    joey-zhou xiaozhi-esp32-server-java
  • Medium 6.3
    CVE-2025-3382

    joey-zhou xiaozhi-esp32-server-java update sql injection

    A vulnerability has been found in joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 and classified as critical. This vulnerability affects the function update of the file /api/user/update. The manipulation of the argument stat…

    joey-zhou xiaozhi-esp32-server-java