Simopro Technology vulnerabilities
We track 6 vulnerabilities in Simopro Technology products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on April 16, 2026.
Latest Simopro Technology vulnerabilities
- 8.8 High severity
WinMatrix: Missing Authentication for Critical Functionality
WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the ag
- 9.8 Critical severity
WinMatrix3 Web package: Improper Neutralization of Special Elements used in an SQL Command
WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- 7.2 High severity
WinMatrix3 Web package: Unrestricted Upload of File with Dangerous Type
WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 9.8 Critical severity
WinMatrix3: Deserialization of Untrusted Data
WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized contents.
- 9.8 Critical severity
WinMatrix3: Improper Neutralization of Special Elements used in an SQL Command
The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.
- 9.8 Critical severity
WinMatrix3: Improper Neutralization of Special Elements used in an SQL Command
The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.