WG
IT Management
WhatsUp Gold
On CISA KEVExploited in the wildRansomware-linked
62
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 21Medium 23Low 0
Watch
Add WhatsUp Gold to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-6005 | 6.9 | Dec 27 | Multiple cross-site scripting (XSS) vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web script or HTML via (1) an SNMP OID object,… Affected: through 16.3 |
| CVE-2026-65940 | 6.8 | Aug 12 | WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server. Affected: before 26.0.2 |
| CVE-2026-65939 | 6.8 | Aug 12 | WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler. Affected: before 26.0.2 |
| CVE-2024-12105 | 6.5 | Dec 31 | WhatsUp Gold - SnmpExtendedActiveMonitor path traversal Affected: 2023.1.0 before 2024.0.2 |
| CVE-2024-5017 | 6.5 | Jun 25 | In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport can lead can lead to… Affected: before 23.1.3 |
| CVE-2024-5014 | 6.5 | Jun 25 | In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature Affected: before 23.1.3 |
| CVE-2022-29848 | 6.5 | May 11 | In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read sensitive… Affected: 17.0.0 through 21.1.1; 22.0.0 |
| CVE-2022-29845 | 6.5 | May 11 | In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the… Affected: 21.1.0; 21.1.1; 22.0.0 |
| CVE-2015-6004 | 6.5 | Dec 27 | Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1) the UniqueID (aka sUniqueID) parameter… Affected: through 16.3 |
| CVE-2023-35759 | 6.1 | Jun 23 | In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input Affected: before 23.0.0 |
| CVE-2021-41318 | 6.1 | Sep 28 | In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input Affected: before 21.1.0 |
| CVE-2024-4562 | 5.4 | May 14 | In WhatsUp Gold versions released before 2023.1.2 , an SSRF vulnerability exists in Whatsup Gold's Issue exists in the HTTP Monitoring functionality. Due to the lack of… Affected: before 23.1.2 |
| CVE-2023-6367 | 5.4 | Dec 14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified Affected: before 23.1.0 |
| CVE-2023-6366 | 5.4 | Dec 14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified Affected: before 23.1.0 |
| CVE-2023-6365 | 5.4 | Dec 14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified Affected: before 23.1.0 |
| CVE-2023-6364 | 5.4 | Dec 14 | In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and… Affected: before 23.1.0 |
| CVE-2025-2572 | 5.3 | Apr 14 | In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents… Affected: before 24.0.3 |
| CVE-2024-8785 | 5.3 | Dec 2 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path… Affected: before 24.0.1 |
| CVE-2024-4561 | 5.3 | May 14 | In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests… Affected: before 23.1.2 |
| CVE-2023-6595 | 5.3 | Dec 14 | In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism Affected: before 23.1.0 |
| CVE-2023-6368 | 5.3 | Dec 14 | In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism Affected: before 23.1.0 |
| CVE-2022-29846 | 5.3 | May 11 | In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold installation serial number Affected: 16.1 through 21.1.1; 22.0.0 |
| CVE-2026-65938 | 4.3 | Aug 12 | WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API. Affected: before 26.0.2 |
Showing 23