Skip to content
OpenAdvisories

Product · Progress Software

WhatsUp Gold

42 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-6670 Exploited · Ransomware Public exploit Scanner template EPSS 93%

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

    Progress Software WhatsUp Gold
    KEV Sep 16, 2024
  • High 8.4
    CVE-2024-5009 Public exploit EPSS 17%

    WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.

    Progress Software WhatsUp Gold
  • Critical 9.8
    CVE-2024-4885 Exploited Public exploit Scanner template EPSS 99%

    WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

    Progress Software WhatsUp Gold
    KEV Mar 3, 2025
  • Critical 9.8
    CVE-2024-4883 Public exploit EPSS 65%

    WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.

    Progress Software WhatsUp Gold
  • High 7.5
    CVE-2023-6595 Public exploit

    WhatsUp Gold Unauthenticated Access to an API Endpoint

    In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.

    Progress Software WhatsUp Gold