Our Vulnerability Research

Common Vulnerabilities and Exposures

SAP security alert for CVE-2025-24870 indicating a critical threat level for insecure secrets management exposing plaintext credentials and access to banking transactions and enterprise data.

What This Vulnerability Research Portfolio Represents

Discoveries That Matter

Our vulnerability research team reverse engineers your enterprise software to find the 0-days that threaten your infrastructure - before attackers do.

Enterprise Focus

The vulnerabilities below affect systems organizations use: SAP. IBM. Check Point. F5. BMC. Microsoft. Rapid7. Cyberark.

Logos of five technology companies: IBM, Check Point, Microsoft, SAP, and CyberArk on a black background.

Current Research

We identified a wide range of CVEs across various industries - each of the vulnerabilities have been assigned a threat level ranging from critical to low. We pride ourselves in beating others to identify critical CVEs in large infrastructure for orgasations such as IBM and Microsoft.

Sort by Threat level
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
CVE-2024-3461
Threat level
Medium

PIN brute force vulnerability in KioWare for Windows due to missing rate limiting on PIN entry

See more
CVE-2024-3460
Threat level
High

Security control bypass in KioWare for Windows allows circumvention of kiosk restrictions

See more
CVE-2024-3459
Threat level
High

Kiosk environment escape in KioWare for Windows allows users to break out of restricted kiosk mode

See more
CVE-2024-33510
Threat level
Low

Text injection vulnerability in Fortinet SSL VPN web UI allows attackers to inject arbitrary text content into the login page

See more
CVE-2024-3050
Threat level
Medium

IP spoofing vulnerability in Site Reviews WordPress plugin allows attackers to bypass IP-based restrictions

See more
CVE-2024-28797
Threat level
Medium

Stored cross-site scripting in IBM InfoSphere DataStage Designer allows persistent script injection affecting other users

See more
CVE-2024-28795
Threat level
Medium

Stored cross-site scripting in IBM InfoSphere Information Server allows persistent malicious script storage

See more
CVE-2024-28794
Threat level
Medium

Stored cross-site scripting in IBM InfoSphere Information Server via different injection point

See more
CVE-2024-24916
Threat level
Medium

DLL hijacking vulnerability in Check Point SmartConsole R82 allows local attackers to execute arbitrary code by placing malicious DLLs

See more
CVE-2024-24915
Threat level
Medium

Credential exposure via memory dump in Check Point SmartConsole allows local attackers to extract authentication credentials from process memory

See more
CVE-2024-24816
Threat level
Medium

Cross-site scripting in CKEditor4 preview feature allows script execution when previewing malicious content

See more
CVE-2024-2218
Threat level
Medium

Admin+ stored XSS in LuckyWP Table of Contents WordPress plugin allows administrators to inject persistent scripts

See more
CVE-2024-1606
Threat level
Medium

HTML injection in BMC Control-M enterprise job scheduler allows injection of arbitrary HTML content

See more
CVE-2024-1605
Threat level
Medium

DLL side-loading in BMC Control-M allows local attackers to execute arbitrary code via malicious DLLs

See more
CVE-2024-1604
Threat level
Medium

Incorrect authorization in BMC Control-M allows users to access functionality beyond their privilege level

See more

We map your systems before testing how they break.

That's why critical findings usually show up outside the original scope - attackers don't respect scope documents.

Book a consultation
arrow_right [#333] Created with Sketch.

Security Assessment Services FAQ

Questions enterprise security teams ask before partnering with AFINE for security assessments.

Is AFINE ISO 27001 certified and what compliance frameworks do you support?

Yes, AFINE is ISO 27001 certified. Beyond certification, we maintain operational security excellence built through 10 years of enterprise work. Our security assessment services support DORA, PCI DSS, SOC 2, ISO 27001, TIBER-EU, NESA, and FCA compliance. We've conducted hundreds of assessments for regulated institutions like PKO BP, ING Bank, and BGK.

What certifications and specialized expertise does AFINE team hold?

Every team member holds minimum OSCP or eWPTX certification. Our researchers average 7-10 years offensive security experience with OSCE, OSWE, OSED, OSEP, CRTO, CSSA, CISSP, CISA, and BSCP certifications. We've published CVEs in SAP, Microsoft, CyberArk, Palo Alto, F5, IBM, and other enterprise software.

What makes AFINE different from other penetration testing vendors?

We've published 150+ CVEs in enterprise software and understand how attackers exploit complex systems beyond automated scanning. Our manual testing finds business logic flaws and attack chains others miss. Isabel Group confirmed we "keep finding critical issues where other pentesters have not found them." Our 10-year exclusive focus on banking, critical infrastructure, and healthcare environments means we understand compliance and production system safety.