Advisories · Technology

Progress Software Corporation WhatsUp Gold.

Every CVE that names Progress Software Corporation WhatsUp Gold among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-65941 CVE record

CVSS 8.8 High

WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.
- Progress Software Corporation WhatsUp Gold
- Path traversal
- Code injection
Not analysed yet 12 Aug 2026
CVE-2026-65940 CVE record

CVSS 6.8 Medium

WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
- Progress Software Corporation WhatsUp Gold
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-65939 CVE record

CVSS 6.8 Medium

WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.
- Progress Software Corporation WhatsUp Gold
- Path traversal
- Unrestricted file upload
Not analysed yet 12 Aug 2026
CVE-2026-65938 CVE record

CVSS 4.3 Medium

WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.
- Progress Software Corporation WhatsUp Gold
- Broken access control
- CWE-602
Not analysed yet 12 Aug 2026
CVE-2026-65937 CVE record

CVSS 8.0 High

WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI
- Progress Software Corporation WhatsUp Gold
- Cross-site scripting (XSS)
Not analysed yet 12 Aug 2026
CVE-2025-2572 CVE record

CVSS 5.6 Medium

WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability
- Progress Software Corporation WhatsUp Gold
- Authentication bypass
Not analysed yet 14 Apr 2025
CVE-2024-12105 CVE record

CVSS 6.5 Medium

WhatsUp Gold - SnmpExtendedActiveMonitor path traversal
- Progress Software Corporation WhatsUp Gold
- Path traversal
Not analysed yet 31 Dec 2024
CVE-2024-12106 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication
- Progress Software Corporation WhatsUp Gold
- Authentication bypass
Not analysed yet 31 Dec 2024
CVE-2024-12108 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WhatsUp Gold - Public API signing key rotation issue
- Progress Software Corporation WhatsUp Gold
- Authentication bypass
Not analysed yet 31 Dec 2024
CVE-2024-8785 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability
- Progress Software Corporation WhatsUp Gold
- CWE-648
Not analysed yet 2 Dec 2024
CVE-2024-46909 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
- Progress Software Corporation WhatsUp Gold
- Path traversal
- CWE-16
Not analysed yet 2 Dec 2024
CVE-2024-46905 CVE record

CVSS 8.8 High

WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability
- Progress Software Corporation WhatsUp Gold
- SQL injection
Not analysed yet 2 Dec 2024
CVE-2024-46906 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability
- Progress Software Corporation WhatsUp Gold
- SQL injection
Not analysed yet 2 Dec 2024
CVE-2024-46907 CVE record

CVSS 8.8 High

WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability
- Progress Software Corporation WhatsUp Gold
- SQL injection
Not analysed yet 2 Dec 2024
CVE-2024-46908 CVE record

CVSS 8.8 High

WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability
- Progress Software Corporation WhatsUp Gold
- SQL injection
Not analysed yet 2 Dec 2024
CVE-2024-7763 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WhatsUp Gold getReport Missing Authentication Authentication Bypass Vulnerability
- Progress Software Corporation WhatsUp Gold
- Authentication bypass
Not analysed yet 24 Oct 2024
CVE-2024-6672 CVE record

CVSS 8.8 High

WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation Vulnerability
- Progress Software Corporation WhatsUp Gold
- SQL injection
Not analysed yet 29 Aug 2024
CVE-2024-6671 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability
- Progress Software Corporation WhatsUp Gold
- SQL injection
Not analysed yet 29 Aug 2024
CVE-2024-6670 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
- Progress Software Corporation WhatsUp Gold
- SQL injection
Not analysed yet 29 Aug 2024
CVE-2024-5019 CVE record

CVSS 5.3 Medium

WhatsUp Gold LoadCSSUsingBasePath Directory Traversal Information Disclosure Vulnerability
- Progress Software Corporation WhatsUp Gold
- Path traversal
Not analysed yet 25 Jun 2024
CVE-2024-5018 CVE record

CVSS 5.3 Medium

WhatsUp Gold LoadUsingBasePath Directory Traversal Information Disclosure Vulnerability
- Progress Software Corporation WhatsUp Gold
- Path traversal
Not analysed yet 25 Jun 2024
CVE-2024-5017 CVE record

CVSS 6.5 Medium

WhatsUp Gold AppProfileImport path traversal vulnerability
- Progress Software Corporation WhatsUp Gold
- Path traversal
Not analysed yet 25 Jun 2024
CVE-2024-5016 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability
- Progress Software Corporation WhatsUp Gold
- Insecure deserialization
Not analysed yet 25 Jun 2024
CVE-2024-5015 CVE record

CVSS 7.1 High

WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability
- Progress Software Corporation WhatsUp Gold
- Server-side request forgery (SSRF)
Not analysed yet 25 Jun 2024
CVE-2024-5014 CVE record

CVSS 7.1 High

WhatsUp Gold GetASPReport Server-Side Request Forgery Information Disclosure
- Progress Software Corporation WhatsUp Gold
- Server-side request forgery (SSRF)
Not analysed yet 25 Jun 2024
CVE-2024-5013 CVE record

CVSS 7.5 High

WhatsUp Gold InstallController Denial-of-Service Vulnerability
- Progress Software Corporation WhatsUp Gold
- Denial of service
Not analysed yet 25 Jun 2024
CVE-2024-5012 CVE record

CVSS 8.6 High

WhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure Vulnerability
- Progress Software Corporation WhatsUp Gold
- Authentication bypass
Not analysed yet 25 Jun 2024
CVE-2024-5011 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

WhatsUp Gold TestController Chart denial of service vulnerability
- Progress Software Corporation WhatsUp Gold
- Denial of service
Not analysed yet 25 Jun 2024
CVE-2024-5010 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

WhatsUp Gold TestController multiple information disclosure vulnerabilities
- Progress Software Corporation WhatsUp Gold
- Information disclosure
Not analysed yet 25 Jun 2024
CVE-2024-5009 CVE record

CVSS 8.4 HighCritical · CVSS 7+ and EPSS

WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability
- Progress Software Corporation WhatsUp Gold
- Privilege escalation
Not analysed yet 25 Jun 2024
CVE-2024-5008 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability
- Progress Software Corporation WhatsUp Gold
- Unrestricted file upload
Not analysed yet 25 Jun 2024
CVE-2024-4885 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability
- Progress Software Corporation WhatsUp Gold
- Path traversal
Not analysed yet 25 Jun 2024
CVE-2024-4884 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability
- Progress Software Corporation WhatsUp Gold
- Command injection
- Code injection
Not analysed yet 25 Jun 2024
CVE-2024-4883 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
- Progress Software Corporation WhatsUp Gold
- Command injection
- Code injection
Not analysed yet 25 Jun 2024
CVE-2024-4562 CVE record

CVSS 5.4 Medium

WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via HttpMonitorSettings
- Progress Software Corporation WhatsUp Gold
- Server-side request forgery (SSRF)
Not analysed yet 14 May 2024
CVE-2024-4561 CVE record

CVSS 4.2 Medium

WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController
- Progress Software Corporation WhatsUp Gold
- Server-side request forgery (SSRF)
Not analysed yet 14 May 2024
CVE-2023-6368 CVE record

CVSS 5.9 Medium

WhatsUp Gold Unauthenticated Access to an API Endpoint
- Progress Software Corporation WhatsUp Gold
- Authentication bypass
Not analysed yet 14 Dec 2023
CVE-2023-6595 CVE record

CVSS 7.5 High

WhatsUp Gold Unauthenticated Access to an API Endpoint
- Progress Software Corporation WhatsUp Gold
- Authentication bypass
Not analysed yet 14 Dec 2023
CVE-2023-6367 CVE record

CVSS 7.6 High

WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles
- Progress Software Corporation WhatsUp Gold
- Cross-site scripting (XSS)
Not analysed yet 14 Dec 2023
CVE-2023-6366 CVE record

CVSS 7.6 High

WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center
- Progress Software Corporation WhatsUp Gold
- Cross-site scripting (XSS)
Not analysed yet 14 Dec 2023
CVE-2023-6365 CVE record

CVSS 7.6 High

WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups
- Progress Software Corporation WhatsUp Gold
- Cross-site scripting (XSS)
Not analysed yet 14 Dec 2023
CVE-2023-6364 CVE record

CVSS 7.6 High

WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard
- Progress Software Corporation WhatsUp Gold
- Cross-site scripting (XSS)
Not analysed yet 14 Dec 2023