whatsupgold vulnerabilities

4 known vulnerabilities in whatsupgold from Progress Software. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  WhatsUp Gold: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-6672Aug 29, 2024Progress Software

  In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalation by modifying a privileged user's password.

• 9.8 Critical severity

  WhatsUp Gold: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-6671Aug 29, 2024Progress SoftwareEPSS 19%

  In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

• 9.8 Critical severity

  Progress WhatsUp Gold SQL Injection Exploited

  CVE-2024-6670Aug 29, 2024Progress SoftwareEPSS 92.9%

  In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

• 8.8 High severity

  WhatsUp Gold: Server-Side Request Forgery

  CVE-2024-5015Jun 25, 2024Progress Software

  In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to es