Login Request a demo
DM
Product
Data Master
by Asustor · last CVE Jul 30, 2026
45
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities45In the news0Timeline
Severity mix
Critical 4High 20Medium 19Low 2
Severity
All severities45Critical4High20Medium19Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Data Master to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-67247
6.5
0%
Jul 30
A path traversal vulnerability was found in the IHM Log handling of ADM
Affected: 4.1.0.rhu2 through 4.3.3.run1; 5.0.0.ra82 before 5.1.4.rjv2
CVE-2026-67246
6.5
0%
Jul 30
A path traversal vulnerability was found in the Wallpaper component of ADM
Affected: 4.1.0.rhu2 through 4.3.3.run1; 5.0.0.ra82 before 5.1.4.rjv2
CVE-2026-3100
6.5
0%
Feb 25
An improper certificate validation vulnerability was found in the FTP Backup on the ADM.
Affected: 4.1.0.rhu2 through 4.3.3.rof1; 5.0.0.ra82 before 5.1.2.reo1
CVE-2018-12315
6.5
1%
Dec 4
Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password
Affected: 3.1.1
CVE-2018-12308
6.5
1%
Dec 4
Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL parameter
Affected: 3.1.1
CVE-2018-15698
6.5
1%
Aug 27
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing the full path to loginimage.cgi
Affected: through 3.1.5
CVE-2018-15697
6.5
1%
Aug 27
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full path
Affected: through 3.1.5
CVE-2018-15695
6.5
1%
Aug 27
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerability in…
Affected: through 3.1.5
CVE-2018-12305
6.1
1%
Dec 4
Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript
Affected: 3.1.1
CVE-2018-15699
6.1
1%
Aug 27
ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS
Affected: through 3.1.5
CVE-2026-24933
5.9
0%
Feb 3
An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.
Affected: 4.1.0.rhu2 through 4.3.3.rof1; 5.0.0.ra82 before 5.1.2.re51
CVE-2026-24932
5.9
0%
Feb 3
An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.
Affected: 4.1.0.rhu2 through 4.3.3.rof1; 5.0.0.ra82 before 5.1.2.re51
CVE-2025-13052
5.9
0%
Dec 12
An improper certificates validation vulnerability was found in the Notification settings of ADM
Affected: 4.1.0.RHU2 before 4.3.3.ROF1; 5.0.0.ra82 before 5.1.1.RCI1
CVE-2026-24935
5.6
0%
Feb 3
An improper certificate validation vulnerability was found in a third-party NAT traversal module.
Affected: 4.1.0.rhu2 through 4.3.3.rof1; 5.0.0.ra82 before 5.1.2.re51
CVE-2023-4475
5.5
0%
Aug 22
An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintended directories
Affected: 4.0.6.ris1 before 4.2.2.ri61
CVE-2023-3699
5.5
0%
Aug 22
An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration
Affected: 4.0.6.ris1 before 4.2.3.rk91
CVE-2018-12311
5.4
1%
Dec 4
Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename
Affected: 3.1.1
CVE-2018-12310
5.4
1%
Dec 4
Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature
Affected: 3.1.1
CVE-2018-15696
4.3
1%
Aug 27
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi
Affected: through 3.1.5
Showing 19