CVE-2018-9276

CVE-2018-9276 — PRTG Network Monitor ⚠️ 免责声明： 本工具仅用于教育目的和授权渗透测试。仅在你拥有或获得明确书面许可的系统上使用。未经授权的使用是非法的。 目录 概述 漏洞详情 工作原理 环境要求 安装 使用方法 示例 缓解措施 参考 概述 PRTG Network Monitor 是 Paessler AG 开发的一款网络监控工具。18.2.39 之前的版本存在通过通知功能实现的认证后命令注入漏洞，允许拥有有效凭据的攻击者以本地系统账户 （PRTG 默认服务账户）的身份实现远程代码执行（RCE） 。 该漏洞由 Josh Berry...

CVE-2018-19410-POC

CVE-2018-19410-POC Prueba de concepto para la vulnerabilidad CVE-2018-19410 Detalles PRTG Network Monitor Versión: 18.2.39.1661 y anteriores Nivel de gravedad: Alto Impacto: Bypass de autenticación, Autorización inadecuada, Inclusión de archivos locales Vector de acceso: Remoto La vulnerabilidad...

CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure

PRTG网络监控器信息泄露 - CVE-2020-11547 远程未认证用户可以通过提供'type'参数，在 /public/login.htm 或 /index.htm 中构造HTTP请求。 示例: http://127.0.0.1/public/login.htm?type=probes 将 probes 替换为以下任何一项以获取不同信息 version cpuload dnsname serverhttpurl windowsversion systemid treestat memory requests screenshot lastsync probes warnings...

CVE-2020-23934

CVE-2020-23934 参考资料 1 https://www.exploit-db.com/exploits/48636 2 https://github.com/vj0shii/PRTG-Network-MonitorCMS-Authenticated-Remote-Code-Execution/blob/master/PRTGCMS.py 3 https://stackoverflow.com/questions/12385179/how-to-send-a-multipart-form-data-with-requests-in-python 4...

CVE-2018-9276

CVE-2018-9276 PRTG 18.2.39 经过身份验证的命令注入（反向Shell） https://nvd.nist.gov/vuln/detail/CVE-2018-9276 改进版利用脚本，原作者为 https://github.com/M4LV0。 我使用了他们脚本中的POST数据，但使其更可靠，因为我之前使用原版时成功率不高。 有效载荷传递方式本质上是 smbdelivery。 Impacket 提供由 msfvenom 生成的 .dll，rundll32.exe 负责执行所有操作。 已在 Windows Server 2016 上针对 PRTG 18.1.37...

PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276

Autenticata esecuzione remota di codice in PRTG Network Monitor Basato su https://www.exploit-db.com/exploits/46527 Utilizzo: modifica manualmente lo script per includere l'URL del target, il nome utente admin e la password come segue: root@kitploit: TARGET = "http://10.129.15.52" USER =...

CVE-2025-67835

Paessler PRTG Network Monitor before 25.4.114 allows Denial-of-Service DoS by an authenticated attacker via the Notification Contacts functionality...

CVE-2025-67834

Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter...

CVE-2025-67833

Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter...

PT-2026-2923

Name of the Vulnerable Software and Affected Versions Paessler PRTG Network Monitor versions prior to 25.4.114 Description An authenticated attacker can cause a Denial-of-Service DoS condition through the Notification Contacts functionality. Recommendations Update to version 25.4.114 or later...

CVE-2025-67834

Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter...

EUVD-2026-2432

Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter...

CVE-2025-67835

Paessler PRTG Network Monitor before 25.4.114 allows Denial-of-Service DoS by an authenticated attacker via the Notification Contacts functionality...

CVE-2025-67833

Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter...

CVE-2025-67835

CVE-2025-67835 affects Paessler PRTG Network Monitor before 25.4.114. An authenticated attacker can trigger a Denial-of-Service via the Notification Contacts feature, impacting availability. The vulnerability is described consistently across multiple sources (NVD/Red Hat/CNNVD/CVE.org) as a DoS c...

CVE-2018-19411

PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account including administrator via an HTTP request because /api/addusers doesn't check, or doesn't properly check, user rights...

CVE-2018-19203

PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request...

CVE-2022-35739

PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary content into the style tag for that device. When the device page loads, the arbitrary Cascading Style Sheets CSS data is inserted into the style tag, loading...

CVE-2019-11074

A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary locations with SYSTEM privileges although not controlling the contents of such files due to insufficient sanitisation when passing arguments to th...

CVE-2020-10374

A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or the what parameter of the screenshot function in the Contact Support form...