Skip to content
OpenAdvisories

Vendor

KUNBUS

14 known vulnerabilities.

Products

piControl 3 Revolution Pi PiCtory 3 RevPiPyLoad 2 Revolution Pi 2 PiCtory 1 PR100088 Modbus gateway 1 Revolution Pi OS Bookworm 1 Revolution Pi webstatus 1 Revolution Pi OS Bullseye 0 linux-image-revpi-v8 0
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-57472

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

    Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows…

    KUNBUS RevPiPyLoad
  • Medium 6.8
    CVE-2026-57471

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

    Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows…

    KUNBUS RevPiPyLoad
  • Medium 5.1
    CVE-2026-57469

    Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory

    Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the con…

    KUNBUS PiCtory
  • Medium 5.9
    CVE-2026-13198

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

    Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated…

    KUNBUS piControl
  • Medium 6.1
    CVE-2025-36558 EPSS 21%

    KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

    KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an sso_token, that script will reply to the u…

    KUNBUS Revolution Pi PiCtory
  • Medium 4.3
    CVE-2024-8685

    Path-Traversal vulnerability in Revolution Pi

    Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to list device directories via the ‘/pictory/php/getFileList.php’ endpoint in the ‘dir’ parameter.

    KUNBUS Revolution Pi