Bexxo supports Swiss SMEs in their IT security.
SwissLabel
Swiss Label Certification
Bexxo is Swiss Label certified, the quality label guaranteeing that our services are provided in Switzerland, by a Swiss company, according to Swiss quality standards.
CyberSafe Switzerland Partner
Bexxo is a certified CyberSafe Switzerland partner, the official Swiss Confederation programme dedicated to promoting cybersecurity for Swiss businesses.
Our Cybersecurity Services
Website Security
01 Complete audit and vulnerability detection
A Bexxo web audit is a comprehensive technical examination of the company's website: automated and manual analysis of vulnerabilities (OWASP Top 10, SQL injections, XSS, CSRF, server configuration), report classified by criticality, and prioritized action plan. Our clients fix an average of 12 to 15 vulnerabilities per engagement, with a clear remediation plan, before they could be exploited.
02 Protection against attacks
Bexxo deploys protections against the most frequent attack vectors: SQL injections, XSS, CSRF, brute force and ClickJacking. These vectors account for 88% of recorded web attacks (Verizon DBIR 2025): identifying and blocking them is enough to eliminate the vast majority of risk. Each measure is documented in the audit report with its criticality level.
03 Data security
The nLPD (in effect since September 1, 2023) sets clear obligations for securing personal data for all Swiss companies. Bexxo supports SMEs in assessing their nLPD compliance, identifying gaps and implementing the required technical measures. Fines of up to CHF 250,000 simply don't apply to our clients.
Enterprise Network Security
01 Network infrastructure audit and analysis
Our network audit maps all exposed attack vectors of your infrastructure, with an ISO 27001 and NIST CSF compliant report. In 2024, the Federal Office for Cybersecurity recorded 62,954 incidents in Switzerland. The audit tells you exactly where you stand.
02 Global IT infrastructure protection
CVE Find, Bexxo's proprietary tool, integrates the MITRE, NVD and CISA KEV databases in real time and sends an alert as soon as a known vulnerability affects the client's systems. Without active monitoring, the average detection time for a network breach reaches 241 days (IBM Cost of a Data Breach 2025). CVE Find reduces that to a matter of hours.
03 Securing access and sensitive data
Bexxo audits authentication policies, assesses password strength, deploys MFA and secures administrator and VPN access. Compromised credentials are behind 22% of data breaches (Verizon DBIR 2025): the most frequent vector, and also the easiest to fix with the right measures.
Our Cybersecurity Solutions
We analyze your entire IT infrastructure to identify potential flaws and improve the security of your connections, equipment, and protocols.
Learn more
We conduct an in-depth diagnosis of your website to detect vulnerabilities and strengthen its protection against cyberattacks, such as SQL injections, XSS flaws, and brute-force attacks.
Learn more
Our experts assist you in developing and optimizing your IT security policy. Together, we define a tailored strategy to secure your systems, reduce risks, and ensure your compliance with current regulations.
Learn more
We implement advanced technologies to protect your infrastructures, networks, and sensitive data. From access management to information encryption, we ensure effective protection against cyber threats.
Learn more
Why choose Bexxo?
Latest Thinking
How we collaborate with you
Listening and understanding
An initial meeting (30–60 min) to identify your systems, sensitive data and legal obligations (Swiss DSA, ISO 27001). No jargon, we speak your language.
In-depth analysis
Manual and automated analysis of your web and network systems. Duration: 3 to 10 days depending on complexity. Result: a complete vulnerability map ranked by criticality.
Correction and reinforcement
You receive a detailed report with a prioritised action plan. Our teams can implement corrections directly or support your IT teams in the remediation process.
Permanent vigilance
Continuous monitoring via CVE Find, real-time alerts on new vulnerabilities affecting your systems, and regular follow-up reports.
Cybersecurity tailored to your challenges
Cyberattacks are becoming increasingly sophisticated and can have disastrous consequences for businesses: loss of critical data, reputational damage, regulatory penalties, and business interruptions. A structured, continuously maintained cybersecurity strategy prevents these risks.
At Bexxo, we offer tailor-made protection solutions, adapted to your needs and compliant with the most demanding security standards, such as ISO 27001/27002 and NIST. In line with NCSC recommendations, we analyze, detect, and correct vulnerabilities in your infrastructure.
Stay ahead with the latest critical security vulnerabilities.
CVE-2026-90647 - CRITICAL
12/09/2026
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.
authorisationproblemOWSAP: A07
CVE-2026-90558 - CRITICAL
12/09/2026
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
CVE-2026-90560 - HIGH
12/09/2026
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
overflow
CVE-2026-90537 - HIGH
12/09/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid dail...
authorisationproblemOWSAP: A01
CVE-2026-15451 - HIGH
12/09/2026
The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-lev...
priviliegemanagementOWSAP: A04
CVE-2026-78175 - HIGH
12/09/2026
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_...
OWSAP: A08
CVE-2026-78159 - CRITICAL
12/09/2026
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it p...
codeinjectionOWSAP: A03
CVE-2026-78006 - CRITICAL
12/09/2026
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attri...
OWSAP: A08
CVE-2026-87759 - HIGH
12/09/2026
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
priviliegemanagementOWSAP: A04
CVE-2026-85681 - CRITICAL
12/09/2026
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled ...
priviliegemanagementOWSAP: A04
CVE-2026-84171 - CRITICAL
12/09/2026
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
fileinclusionOWSAP: A04
CVE-2026-84047 - HIGH
12/09/2026
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
sqlinjectionOWSAP: A03
CVE-2026-82845 - CRITICAL
12/09/2026
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the s...
OWSAP: A08
CVE-2026-81742 - HIGH
12/09/2026
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.
crosssitescriptingOWSAP: A03
CVE-2026-81402 - CRITICAL
12/09/2026
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
fileinclusionOWSAP: A04
CVE-2026-80494 - HIGH
12/09/2026
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
OWSAP: A01
CVE-2026-80491 - HIGH
12/09/2026
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.
sqlinjectionOWSAP: A03
CVE-2026-77006 - CRITICAL
12/09/2026
The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
OWSAP: A04
CVE-2026-77005 - CRITICAL
12/09/2026
The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
OWSAP: A04
CVE-2026-75800 - CRITICAL
12/09/2026
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
authorisationproblemOWSAP: A07