CVE-2018-9276

CVE-2018-9276 affects Paessler PRTG Network Monitor (pre-18.2.39). An OS command injection can be triggered by an attacker who has administrative access to the PRTG System Administrator web console, via malformed parameters in sensor or notification management scenarios. This vulnerability could ...

CVE-2018-19410

CVE-2018-19410 affects Paessler PRTG Network Monitor prior to 18.2.40.1683. An unauthenticated remote attacker can craft HTTP requests to override the include directive in /public/login.htm, trigger a Local File Inclusion by including /api/addusers, and create users with read-write privileges (in...

CVE-2020-11547

CVE-2020-11547 affects Paessler PRTG Network Monitor prior to 20.1.57.1745. The vulnerability is an information-disclosure flaw that allows remote unauthenticated attackers to retrieve details about probes running or the server (CPU usage, memory, Windows version, internal statistics) via HTTP re...

CVE-2023-32781

CVE-2023-32781 affects Paessler PRTG Network Monitor, specifically the HL7 sensor in versions 23.2.84.1566 and earlier. Affects an authenticated user with write permissions who can abuse the sensor’s debug option to write new files, potentially enabling execution by the EXE/Script sensor and resu...

CVE-2019-11073

The CVE-2019-11073 entry concerns PRTG Network Monitor prior to 19.4.54.1506, with a Remote Code Execution flaw caused by insufficient sanitization when passing arguments to HttpTransactionSensor.exe. Exploitation requires remote authenticated administrators to create a new HTTP Transaction Senso...

CVE-2024-12833

CVE-2024-12833 describes a cross-site scripting authentication-bypass flaw in the Paessler PRTG Network Monitor web interface. The root cause is insufficient validation of user-supplied data, enabling injection of arbitrary script and allowing network-adjacent attackers to bypass authentication w...

CVE-2019-11074

PRTG Network Monitor

CVE-2022-35739

PRTG Network Monitor vulnerable through version 22.2.77.2204 where custom input on a device icon can inject arbitrary CSS into the device’s style tag. When the device page loads, the injected CSS may load malicious content. The issue cannot be escalated to XSS due to input restrictions and browse...

CVE-2018-19411

CVE-2018-19411 affects Paessler PRTG Network Monitor prior to 18.2.40.1683. An authenticated user with read-only privileges can create another user with read-write privileges (including administrator) via an HTTP request to /api/addusers because rights are not properly checked. Impact, per source...

CVE-2018-19204

PRTG Network Monitor

CVE-2020-14073

CVE-2020-14073 : In Paessler PRTG Network Monitor 20.1.56.1574, a stored XSS exists in the Map Designer via crafted map properties. An attacker with Read/Write privileges can create a map and inject JavaScript through the Map Designer Properties screen, affecting any user with View Maps or Edit M...

CVE-2018-10253

Paessler PRTG Network Monitor prior to version 18.1.39.1648 is affected by a stack memory handling issue during API calls, described as a stack overflow/DoS vulnerability. Public references (CNVD/OpenVAS/Exploit-DB) indicate the vulnerability can be triggered remotely and leads to denial of servi...

CVE-2020-10374

The CVE-2020-10374 affects Paessler PRTG Network Monitor (webserver component) from version 19.2.50 up to 20.1.56, enabling unauthenticated remote command execution via a crafted POST request or via the what parameter of the Contact Support form’s screenshot function. This is a remote, network-ac...

CVE-2021-27220

PRTG Network Monitor before 21.1.66.1623 is affected by an information disclosure vulnerability: invoking the screenshot function with prepared context paths can cause verification of certain files on the web server filesystem. Root cause is excessive disclosure via the screenshot feature. Impact...

CVE-2023-31449

The CVE-2023-31449 entry describes a path traversal in Paessler PRTG Network Monitor’s WMI Custom sensor (versions 23.2.84.1566 and earlier). An authenticated user with write permissions could exploit the WMI Custom sensor to behave differently for existing vs non-existing files, enabling path tr...

CVE-2018-14683

CVE-2018-14683 affects PRTG Network Monitor prior to 19.1.49.1966, with Cross Site Scripting (XSS) in the WEBGUI reported. Public sources in the connected documents confirm the issue and describe the impact as an XSS vulnerability in the WEBGUI interface. The CVSS metrics shown in the connected r...

CVE-2023-51630

CVE-2023-51630 affects Paessler PRTG Network Monitor. The flaw is a cross-site scripting issue in the web console caused by insufficient validation of user-supplied data, enabling the injection of arbitrary scripts. This can be exploited to bypass authentication on affected installations, with us...

CVE-2017-15008

CVE-2017-15008 affects PRTG Network Monitor version 17.3.33.2830. The issue is a stored Cross-Site Scripting vulnerability in sensor titles caused by incorrect error handling for a %00 in the SRC attribute of an IMG element. This could allow an attacker to inject script or HTML when malicious dat...

CVE-2019-9207

CVE-2019-9207 affects PRTG Network Monitor 7.1.3.3378 . The vulnerability is an XSS flaw exploitable via the /search.htm endpoint using the searchtext parameter. Public records consistently describe a cross-site scripting vulnerability in this version; the product is noted as discontinued. The co...

CVE-2021-29643

CVE-2021-29643 affects Paessler PRTG Network Monitor prior to 21.3.69.1333. The issue is a stored cross-site scripting (XSS) vulnerability arising from an unsanitized string imported from a User Object in a connected Active Directory instance. Impact is stored XSS in the browser context, enabling...

CVE-2017-15651

PRTG Network Monitor 17.3.33.2830 contains an arbitrary code execution flaw that can be exploited by a remote authenticated administrator who uploads a .exe and proceeds despite an error message, allowing code execution with the attacker’s privileges. The vulnerability stems from processing the u...

CVE-2017-15360

CVE-2017-15360 affects PRTG Network Monitor version 17.3.33.2830, where stored Cross-Site Scripting is possible in all created group names due to incorrect HTML-encoded script error handling. The connected documents confirm the vulnerability description but do not provide concrete remediation det...

CVE-2016-5078

CVE-2016-5078 affects Paessler PRTG before version 16.2.24.4045, containing a cross‑site scripting (XSS) vulnerability via SNMP. The description in multiple sources confirms the issue is a PRTG XSS via SNMP path, with the vulnerable component being the PRTG Web UI flow triggered by SNMP data. The...

CVE-2019-19119

PRTG Network Monitor (versions 7.x–19.4.53) exposes admin credentials due to insufficient access control on local registry keys for the Core Server Service. This local-privilege issue can be exploited by a non-administrative user on the same machine; CVSS metrics indicate Confidentiality Impact H...

CVE-2018-19203

The CVE affects PRTG Network Monitor prior to version 18.2.41.1652. A remote unauthenticated attacker can terminate the PRTG Core Server Service via a crafted HTTP request, resulting in a denial of service to the monitoring core. This is a network-accessible impact (no authentication required) wi...

CVE-2017-9816

CVE-2017-9816 is a cross-site scripting (XSS) vulnerability in Paessler PRTG Network Monitor, reported for versions prior to 17.2.32.2279. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the web interface. Connected sources (CNVD-2017-30012 and ...

CVE-2023-31450

CVE-2023-31450 affects Paessler PRTG Network Monitor, specifically the SQL v2 sensors up to version 23.2.84.1566. An authenticated user with write permissions could trigger path traversal by manipulating the SQL v2 sensor behavior for existing vs non-existing files, enabling execution of files ou...

CVE-2015-7743

CVE-2015-7743 concerns Paessler PRTG Network Monitor. The vulnerability is an XML External Entity (XXE) expansion flaw in which authenticated users who can create a new HTTP XML/REST Value sensor can read arbitrary files on the PRTG host by supplying crafted XML. Affected versions: before 16.2.23...

CVE-2017-15009

CVE-2017-15009 affects PRTG Network Monitor (v17.3.33.2830). The vulnerability is a reflected Cross‑Site Scripting flaw on the error page (error.htm) via the errormsg parameter. Documented CVSS values (NVD) indicate a network-facing issue with medium base severity (CVSS2: 4.3; CVSS3: 6.1) and use...

CVE-2019-9206

The CVE-2019-9206 entry concerns Paessler AG PRTG Network Monitor v7.1.3.3378, which allows cross-site scripting via the /public/login.htm endpoint using the errormsg or loginurl parameters. The description indicates a reflected-type XSS that could inject arbitrary scripts through these parameter...

CVE-2017-15917

In Paessler PRTG Network Monitor 17.3.33.2830, a read-only user can forge and send a crafted request to the server to create a Map, enabling unintended map creation by non-privileged users. The information confirms the affected product and the faulty operation (Map creation by a read-only user) b...

CVE-2023-31452

CVE-2023-31452 is a CSRF token bypass in Paessler PRTG Network Monitor, affecting version 23.2.84.1566 and earlier. It lets a remote attacker with a victim’s active session perform actions, potentially including creating new users (severity CVSS 3.1 base score 8.8). Mitigation: Paessler has addre...

CVE-2017-12879

Paessler PRTG Network Monitor (before version 17.3.33.2654) contains a stored XSS in the DEVICES OR SENSORS feature. Exploitation requires authentication and remote access; an attacker can inject arbitrary web script or HTML, with the impact described as partial integrity impact and low confident...

CVE-2023-31448

CVE-2023-31448 affects Paessler PRTG Network Monitor: the HL7 sensor in version 23.2.84.1566 and earlier allows an authenticated user with write privileges to manipulate HL7 input and cause path traversal, enabling execution of files outside the designated custom sensors folder. This results in p...

CVE-2021-34547

CVE-2021-34547 affects Paessler PRTG Network Monitor (version 20.1.55.1775) and is a CSRF flaw in the /editsettings endpoint that can lead to unintended user-creation actions. The description explicitly states a cross-site request forgery vulnerability in the web application, enabling an attacker...

CVE-2023-32782

CVE-2023-32782 affects Paessler PRTG Network Monitor, specifically the Dicom C-ECHO sensor in versions up to 23.2.84.1566. The underlying issue is a command-injection vulnerability where an authenticated user with write permissions can abuse the debug option to write new files that may be execute...

CVE-2025-67835

CVE-2025-67835 affects Paessler PRTG Network Monitor before 25.4.114. An authenticated attacker can trigger a Denial-of-Service via the Notification Contacts feature, impacting availability. The vulnerability is described consistently across multiple sources (NVD/Red Hat/CNNVD/CVE.org) as a DoS c...

CVE-2025-67834

Paessler PRTG Network Monitor is affected by an unauthenticated XSS vulnerability via the filter parameter in versions prior to 25.4.114. This is described across multiple connected sources (Red Hat, NVD, CVE listings, PT Security) indicating that the issue manifests as cross-site scripting when ...

CVE-2025-67833

CVE-2025-67833 affects Paessler PRTG Network Monitor and is an XSS vulnerability. Versions prior to 25.4.114 allow an unauthenticated attacker to execute script via the tag parameter. There is no exploitation detail provided beyond this description in the connected documents. Impact is cross-site...