Synel develops time-and-attendance tracking systems and workforce management software, with its vulnerability footprint concentrated in products such as the Synergy/A platform and related hardware appliances including the SY-7500 and SY-751 terminals. The disclosures skew strongly toward critical-severity outcomes and recur through application-layer weaknesses including cross-site scripting, OS command injection, path traversal, improper authentication, and unauthenticated code download, reflecting the web-facing and command-execution surface of access-control and scheduling infrastructure. Live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Synel over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-37220CRITICAL
Synel Terminals - CWE-494: Download of Code Without Integrity Check
| Sep 3, 2023 | 9.8 | 29 | NO | NO |
CVE-2023-37213CRITICAL Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection' | Jul 30, 2023 | 9.8 | 27 | NO | NO |
CVE-2023-32227CRITICAL Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials | Jul 30, 2023 | 9.8 | 27 | NO | NO |
CVE-2022-22790HIGH SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parame | Jan 28, 2022 | 7.5 | 24 | NO | NO |
CVE-2012-2970HIGH The Synel SY-780/A Time & Attendance terminal allows remote attackers to cause a denial of service (device hang) via network traffic to port (1) 1641, (2) 3734, or (3) 3735. | Jul 9, 2012 | 7.8 | 23 | NO | NO |
CVE-2021-36718MEDIUM SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report of eharmony system with sensetive data (Employee name, Empl | Dec 8, 2021 | 6.5 | 22 | NO | NO |
CVE-2022-36778MEDIUM insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code. | Sep 13, 2022 | 5.4 | 20 | NO | NO |
CVE-2022-22791MEDIUM SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the s | Jan 28, 2022 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Synel.
Media articles that mention a CVE ID that affects a product developed by Synel — matched by CVE ID, not by vendor name.