# Progress Software Corporation WhatsUp Gold. Every CVE that names Progress Software Corporation WhatsUp Gold among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.](https://agentprime.io/advisories/CVE-2026-65941.md) `CVE-2026-65941` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, Code injection, Authentication bypass, Server-side request forgery (SSRF) - [WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.](https://agentprime.io/advisories/CVE-2026-65940.md) `CVE-2026-65940` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 6.8 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control - [WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.](https://agentprime.io/advisories/CVE-2026-65939.md) `CVE-2026-65939` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 6.8 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, Unrestricted file upload - [WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.](https://agentprime.io/advisories/CVE-2026-65938.md) `CVE-2026-65938` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control, CWE-602 - [WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI](https://agentprime.io/advisories/CVE-2026-65937.md) `CVE-2026-65937` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.0 High · Not analysed yet · Published 12 Aug 2026 · Tags: Cross-site scripting (XSS) - [WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability](https://agentprime.io/advisories/CVE-2025-2572.md) `CVE-2025-2572` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 5.6 Medium · Not analysed yet · Published 14 Apr 2025 · Tags: Authentication bypass - [WhatsUp Gold - SnmpExtendedActiveMonitor path traversal](https://agentprime.io/advisories/CVE-2024-12105.md) `CVE-2024-12105` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 6.5 Medium · EPSS 0.42 · Not analysed yet · Published 31 Dec 2024 · Tags: Path traversal - [WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication](https://agentprime.io/advisories/CVE-2024-12106.md) `CVE-2024-12106` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Dec 2024 · Tags: Authentication bypass - [WhatsUp Gold - Public API signing key rotation issue](https://agentprime.io/advisories/CVE-2024-12108.md) `CVE-2024-12108` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Dec 2024 · Tags: Authentication bypass - [WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-8785.md) `CVE-2024-8785` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Dec 2024 · Tags: CWE-648 - [WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-46909.md) `CVE-2024-46909` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.49 · Not analysed yet · Published 2 Dec 2024 · Tags: Path traversal, CWE-16 - [WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2024-46905.md) `CVE-2024-46905` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.8 High · Not analysed yet · Published 2 Dec 2024 · Tags: SQL injection - [WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2024-46906.md) `CVE-2024-46906` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.40 · Not analysed yet · Published 2 Dec 2024 · Tags: SQL injection - [WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2024-46907.md) `CVE-2024-46907` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.8 High · Not analysed yet · Published 2 Dec 2024 · Tags: SQL injection - [WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2024-46908.md) `CVE-2024-46908` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.8 High · Not analysed yet · Published 2 Dec 2024 · Tags: SQL injection - [WhatsUp Gold getReport Missing Authentication Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2024-7763.md) `CVE-2024-7763` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2024 · Tags: Authentication bypass - [WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2024-6672.md) `CVE-2024-6672` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.8 High · Not analysed yet · Published 29 Aug 2024 · Tags: SQL injection - [WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2024-6671.md) `CVE-2024-6671` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 29 Aug 2024 · Tags: SQL injection - [WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2024-6670.md) `CVE-2024-6670` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.93 · Not analysed yet · Published 29 Aug 2024 · Tags: SQL injection - [WhatsUp Gold LoadCSSUsingBasePath Directory Traversal Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-5019.md) `CVE-2024-5019` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2024 · Tags: Path traversal - [WhatsUp Gold LoadUsingBasePath Directory Traversal Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-5018.md) `CVE-2024-5018` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2024 · Tags: Path traversal - [WhatsUp Gold AppProfileImport path traversal vulnerability](https://agentprime.io/advisories/CVE-2024-5017.md) `CVE-2024-5017` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 6.5 Medium · Not analysed yet · Published 25 Jun 2024 · Tags: Path traversal - [WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-5016.md) `CVE-2024-5016` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 25 Jun 2024 · Tags: Insecure deserialization - [WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-5015.md) `CVE-2024-5015` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.1 High · Not analysed yet · Published 25 Jun 2024 · Tags: Server-side request forgery (SSRF) - [WhatsUp Gold GetASPReport Server-Side Request Forgery Information Disclosure](https://agentprime.io/advisories/CVE-2024-5014.md) `CVE-2024-5014` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.1 High · Not analysed yet · Published 25 Jun 2024 · Tags: Server-side request forgery (SSRF) - [WhatsUp Gold InstallController Denial-of-Service Vulnerability](https://agentprime.io/advisories/CVE-2024-5013.md) `CVE-2024-5013` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2024 · Tags: Denial of service - [WhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-5012.md) `CVE-2024-5012` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.6 High · Not analysed yet · Published 25 Jun 2024 · Tags: Authentication bypass - [WhatsUp Gold TestController Chart denial of service vulnerability](https://agentprime.io/advisories/CVE-2024-5011.md) `CVE-2024-5011` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.47 · Not analysed yet · Published 25 Jun 2024 · Tags: Denial of service - [WhatsUp Gold TestController multiple information disclosure vulnerabilities](https://agentprime.io/advisories/CVE-2024-5010.md) `CVE-2024-5010` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.70 · Not analysed yet · Published 25 Jun 2024 · Tags: Information disclosure - [WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2024-5009.md) `CVE-2024-5009` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 25 Jun 2024 · Tags: Privilege escalation - [WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-5008.md) `CVE-2024-5008` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 25 Jun 2024 · Tags: Unrestricted file upload - [WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-4885.md) `CVE-2024-4885` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 25 Jun 2024 · Tags: Path traversal - [WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-4884.md) `CVE-2024-4884` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 25 Jun 2024 · Tags: Command injection, Code injection - [WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-4883.md) `CVE-2024-4883` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.65 · Not analysed yet · Published 25 Jun 2024 · Tags: Command injection, Code injection - [WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via HttpMonitorSettings](https://agentprime.io/advisories/CVE-2024-4562.md) `CVE-2024-4562` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 5.4 Medium · Not analysed yet · Published 14 May 2024 · Tags: Server-side request forgery (SSRF) - [WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController](https://agentprime.io/advisories/CVE-2024-4561.md) `CVE-2024-4561` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 4.2 Medium · Not analysed yet · Published 14 May 2024 · Tags: Server-side request forgery (SSRF) - [WhatsUp Gold Unauthenticated Access to an API Endpoint](https://agentprime.io/advisories/CVE-2023-6368.md) `CVE-2023-6368` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 5.9 Medium · Not analysed yet · Published 14 Dec 2023 · Tags: Authentication bypass - [WhatsUp Gold Unauthenticated Access to an API Endpoint](https://agentprime.io/advisories/CVE-2023-6595.md) `CVE-2023-6595` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.5 High · Not analysed yet · Published 14 Dec 2023 · Tags: Authentication bypass - [WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles](https://agentprime.io/advisories/CVE-2023-6367.md) `CVE-2023-6367` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.6 High · Not analysed yet · Published 14 Dec 2023 · Tags: Cross-site scripting (XSS) - [WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center](https://agentprime.io/advisories/CVE-2023-6366.md) `CVE-2023-6366` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.6 High · Not analysed yet · Published 14 Dec 2023 · Tags: Cross-site scripting (XSS) - [WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups](https://agentprime.io/advisories/CVE-2023-6365.md) `CVE-2023-6365` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.6 High · Not analysed yet · Published 14 Dec 2023 · Tags: Cross-site scripting (XSS) - [WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard](https://agentprime.io/advisories/CVE-2023-6364.md) `CVE-2023-6364` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 7.6 High · Not analysed yet · Published 14 Dec 2023 · Tags: Cross-site scripting (XSS) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .