Centralsquare develops web-based government software for community development, permitting, and municipal services, where its disclosures cluster around access-control and input-handling weaknesses including SQL injection, cross-site scripting, authentication bypass, and missing authorization. Treat this as a compact vendor profile; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Centralsquare over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-64281CRITICAL An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials. | Nov 12, 2025 | 9.8 | 34 | NO | NO |
CVE-2025-64280CRITICAL A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field. | Nov 12, 2025 | 9.8 | 30 | NO | NO |
CVE-2025-29980CRITICAL A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the cur | Mar 20, 2025 | 9.8 | 27 | NO | NO |
CVE-2025-59491MEDIUM Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields. | Nov 12, 2025 | 6.1 | 21 | NO | NO |
CVE-2023-40362MEDIUM An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contrac | Jan 12, 2024 | 4.3 | 16 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Centralsquare.
Media articles that mention a CVE ID that affects a product developed by Centralsquare — matched by CVE ID, not by vendor name.