bandido
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| MORKVA Vchasno Kasa Integration | 2 | – | Jul 19, 2025 |
| Checkbox | 1 | – | Nov 21, 2025 |
| Morkva UA Shipping | 1 | – | Mar 4, 2026 |
| Ukrposhta | 1 | – | Jan 7, 2025 |
Exploited and recent CVEs
- CVE-2026-2292 Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field 0.3%
- CVE-2025-12170 Checkbox <= 2.8.10 - Missing Authorization to Unauthenticated Log Clearing 0.2%
- CVE-2025-6720 Vchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearing 0.4%
- CVE-2025-6721 Vchasno Kasa <= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation 0.4%
- CVE-2024-12049 Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters 0.5%