WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6671 info: name: WhatsUp Gold GetStatisticalMonitorList SQL Injectio...

CVE-2024-6670

CVE-2024-6670 PoC para la vulnerabilidad de inyección SQL y omisión de autenticación HasErrors en Progress Software WhatsUp Gold CVE-2024-6670 Se puede encontrar un análisis de causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/ Uso...

CVE-2024-4883

CVE-2024-4883 PoC para CVE-2024-4883 Progress WhatsUp Gold WriteDatafile Ejecución Remota de Código No Autenticada CVE-2024-4883 Análisis Técnico Un análisis de causa raíz de la vulnerabilidad se puede encontrar en mi blog:...

CVE-2024-4885

CVE-2024-4885 PoC para CVE-2024-4885 Progress WhatsUp Gold GetFileWithoutZip Remote Code Execution No Autenticado CVE-2024-4885 Análisis Técnico Se puede encontrar un análisis de causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/progress-whatsup-gold-rce-cve-2024-4885/ Uso...

CVE-2024-5009

CVE-2024-5009 PoC para la escalada de privilegios de SetAdminPassword en Progress WhatsUp Gold CVE-2024-5009 Puedes encontrar un análisis de la causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/progress-whatsup-gold-privesc-setadminpassword-cve-2024-5009/ Uso python3...

CVE-2024-5009

CVE-2024-5009 : WhatsUp Gold SetAdminPassword 权限提升 CVEHunter 工具，用于检测和利用 CVE-2024-5009 漏洞，具有异步高性能。 安装 git clone https://github.com/th3gokul/CVE-2024-5009.git cd CVE-2024-5009 pip install -r requirements.txt python3 cvehunter.py --help 🚀 使用方法 python3 cvehunter.py -h / |\ \ / /| || | | | | | | | \ \...

WhatsUp Gold HasErrors SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6670 info: name: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass author: DhiyaneshDK,princechaddha severity:...

CVE-2026-65941

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65937

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65940

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

CVE-2026-65938

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-65941 WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65941

CVE-2026-65941 affects WhatsUp Gold releases prior to 2026.0.2. An unauthenticated remote attacker with network access to the affected IIS-backed service can execute arbitrary code in the context of the IIS application service account. The CVE is documented by NVD and CVE records, with a high imp...

CVE-2026-65941 WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65941

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

EUVD-2026-57267

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

EUVD-2026-57266

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

CVE-2026-65940

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

CVE-2026-65940 WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...