Sun.net vulnerabilities
We track 7 vulnerabilities in Sun.net products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on May 2, 2026.
Latest Sun.net vulnerabilities
- 7.2 High severity
CTMS: Unrestricted Upload of File with Dangerous Type
CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 8.8 High severity
CTMS: Improper Neutralization of Special Elements used in an SQL Command
CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- 9.8 Critical severity
Corporate Training Management System: External Control of File Name or Path
An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path.
- 9.8 Critical severity
Corporate Training Management System: Unrestricted Upload of File with Dangerous Type
An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write malicious code in a specific file, which may lead to arbitrary code execution.
- 9.8 Critical severity
Corporate Training Management System: Missing Authorization
A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks.
- 9.8 Critical severity
Corporate Training Management System: Missing Authentication for Critical Functionality
A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deployment functionality without prior authentication.
- 8.8 High severity
CTMS: Improper Limitation of a Pathname to a Restricted Directory
SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system