CVE-2018-9276

CVE-2018-9276 CVE-2018-9276 PRTG 18.2.39 Reverse Shell Python3 support Dependancies Impacket python3 version Netcat Msfvenom Usage git clone https://github.com/A1vinSmith/CVE-2018-9276.git ./exploit.py -i targetIP -p targetPort --lhost hostIP --lport hostPort --user user --password pass 1. The...

CVE-2018-19410-POC

CVE-2018-19410-POC Proof of concept for the vulnerability CVE-2018-19410 Details PRTG Network Monitor Version: 18.2.39.1661 and earlier Severity level: High Impact: Authentication Bypass, Improper Authorization, Local File Inclusion Access Vector: Remote The vulnerability permits remote and...

PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276

Authenticated PRTG network Monitor remote code execution Based on https://www.exploit-db.com/exploits/46527 Usage: simply manually edit the script to include your Target URL, admin username and password like so: TARGET = "http://10.129.15.52" USER = "prtgadmin" PASS = "PrTg@dmin2019" Then insert...

CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure

PRTG-Network-Monitor-Information-Disclosure - CVE-2020-11547 Remote unauthenticated user can craft an HTTP request in /public/login.htm or /index.htm by providing the 'type' parameter. Example: http://127.0.0.1/public/login.htm?type=probes replace probes by any of the following to get diferent in...

CVE-2018-9276

CVE-2018-9276 — PRTG Network Monitor ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal. Table of Contents Overview Vulnerability Details...

CVE-2020-23934

CVE-2020-23934 References 1 https://www.exploit-db.com/exploits/48636 2 https://github.com/vj0shii/PRTG-Network-MonitorCMS-Authenticated-Remote-Code-Execution/blob/master/PRTGCMS.py 3 https://stackoverflow.com/questions/12385179/how-to-send-a-multipart-form-data-with-requests-in-python 4...

CVE-2018-9276

CVE-2018-9276 PRTG 18.2.39 Authenticated Command Injection Reverse Shell https://nvd.nist.gov/vuln/detail/CVE-2018-9276 Improved version of an exploit written by https://github.com/M4LV0. I used the POST data from their script but just made it more reliable as I didnt have much success with it...

CVE-2026-4638

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG...

CVE-2026-4638 Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG...

CVE-2026-4638 Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG...

EUVD-2026-85847

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG...

CVE-2026-4638

PRTG Network Monitor versions before 26.2.120.1449 are vulnerable to plaintext password disclosure. The issue exists in a demo EXE/Script sensor that utilizes cscript.exe to multiply two integer parameters. If a non-numeric value is provided, cscript.exe generates a 'Type mismatch' runtime error ...

CVE-2026-4637

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

CVE-2026-4637 Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

CVE-2026-4637

Paessler PRTG Network Monitor (versions before 26.2.120.1449 ) is vulnerable to a reflected Cross-Site Scripting (XSS) flaw. The issue occurs because the web interface returns an HTTP 403 "Forbidden Path" error page for non-existent resources ending in ".htm" and echoes the requested URL path int...

EUVD-2026-85840

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

CVE-2026-4637 Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

PT-2026-97781

Name of the Vulnerable Software and Affected Versions PRTG Network Monitor versions prior to 26.2.120.1449 Description A demo EXE/Script sensor uses cscript.exe to multiply two integer parameters. When a non-numeric value is provided instead of an integer, cscript.exe triggers a 'Type mismatch'...

CVE-2026-4637: Improper Neutralization of Input During Web Page Generation

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

CVE-2026-4638: Generation of Error Message Containing Sensitive Information

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG...