CVE-2024-4885

CVE-2024-4885 针对 CVE-2024-4885 Progress WhatsUp Gold GetFileWithoutZip 未授权远程代码执行（CVE-2024-4885）的 PoC 技术分析 有关该漏洞的根因分析可参见我的博客： https://summoning.team/blog/progress-whatsup-gold-rce-cve-2024-4885/ 用法 root@kitploit: python3 CVE-2024-4885.py -t http://192.168.0.231:9642 -s 192.168.0.181:1337 -f hax.as...

CVE-2024-4883

CVE-2024-4883 CVE-2024-4883 的 PoC：Progress WhatsUp Gold WriteDatafile 未授权远程代码执行（CVE-2024-4883） 技术分析 漏洞的根本原因分析可在我博客上找到： https://summoning.team/blog/progress-whatsup-gold-WriteDataFile-CVE-2024-4883-RCE/ 用法 root@kitploit: WhatsUpWriteDataFileExploit.exe --target 192.168.0.11 --port 9643 --webshell...

CVE-2024-6670

CVE-2024-6670 Progress Software WhatsUp Gold HasErrors SQL注入认证绕过漏洞 CVE-2024-6670 的PoC 该漏洞的根本原因分析可在我博客中找到： https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/ 使用方法 root@kitploit: python CVE-2024-6670.py --newpassword Pwned --target-url https://192.168.201.150 | | | | | | | | | | ...

WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6671 info: name: WhatsUp Gold GetStatisticalMonitorList SQL Injectio...

CVE-2024-5009

CVE-2024-5009 Progress WhatsUp Gold SetAdminPassword 权限提升漏洞（CVE-2024-5009）的PoC 关于该漏洞的根本原因分析可在我的博客中找到： https://summoning.team/blog/progress-whatsup-gold-privesc-setadminpassword-cve-2024-5009/ 使用方法 root@kitploit: python3 CVE-2024-5009.py --target https://192.168.0.231/ | | | | | | | | | | | | \ | ...

WhatsUp Gold HasErrors SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6670 info: name: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass author: DhiyaneshDK,princechaddha severity:...

CVE-2024-5009

CVE-2024-5009 : WhatsUp Gold SetAdminPassword 权限提升 CVEHunter 工具，用于检测和利用 CVE-2024-5009 漏洞，具有异步高性能。 安装 root@kitploit: git clone https://github.com/th3gokul/CVE-2024-5009.git cd CVE-2024-5009 pip install -r requirements.txt python3 cvehunter.py --help 🚀 使用方法 root@kitploit: python3 cvehunter.py -h / ...

CVE-2026-65941

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65937

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...

CVE-2026-65938

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65940

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

CVE-2026-65941 WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65941

CVE-2026-65941 affects WhatsUp Gold releases prior to 2026.0.2. An unauthenticated remote attacker with network access to the affected IIS-backed service can execute arbitrary code in the context of the IIS application service account. The CVE is documented by NVD and CVE records, with a high imp...

EUVD-2026-57267

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

CVE-2026-65941

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

EUVD-2026-57266

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

CVE-2026-65940

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

CVE-2026-65940 WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...

CVE-2026-65940

WhatsUp Gold is affected in versions released before 2026.0.2. The issue stems from excessive file system permissions, enabling a privileged attacker to write arbitrary files to a web-accessible location on the host server. Remediation inferred: upgrade to 26.0.2 or later.