Cybelesoft develops a focused portfolio of remote-access and virtualization products such as Thinfinity VirtualUI, Workspace, and Remote Desktop solutions that enable thin-client connectivity and resource sharing. The vendor's vulnerabilities skew toward serious outcomes and frequently acquire public exploit code; the recurring weakness classes—missing authentication controls, path traversal, cross-site scripting, and information-disclosure issues—are characteristic of web-facing remote-access platforms where input validation and access control are critical to security boundaries. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cybelesoft over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-45092CRITICAL Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter. | Dec 16, 2021 | 9.8 | 72 | NO | YES |
CVE-2021-46354HIGH Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability t | Feb 9, 2022 | 7.5 | 43 | NO | YES |
CVE-2021-44848MEDIUM In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists. | Dec 13, 2021 | 5.3 | 42 | NO | YES |
CVE-2024-40404CRITICAL Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established. | Nov 13, 2024 | 9.8 | 31 | NO | NO |
CVE-2022-25227HIGH Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse maliciou | May 20, 2022 | 8.8 | 27 | NO | NO |
CVE-2019-16384MEDIUM Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables files outside of the web directory to be retrieved if the exact | Jun 4, 2020 | 6.5 | 23 | NO | NO |
CVE-2024-40407HIGH A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors. | Nov 13, 2024 | 7.5 | 22 | NO | NO |
CVE-2024-40405HIGH Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request. | Nov 13, 2024 | 8.1 | 22 | NO | NO |
CVE-2024-40408HIGH Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to creat | Nov 13, 2024 | 7.3 | 21 | NO | NO |
CVE-2019-16385MEDIUM Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. T | Jun 4, 2020 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cybelesoft.
Media articles that mention a CVE ID that affects a product developed by Cybelesoft — matched by CVE ID, not by vendor name.