Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2025-34239

Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.

CVSS 4.0 · 8.6 High EPSS 1.7% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34238

Advantech WebAccess/VPN < 1.1.5 Path Traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34245

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34247

Advantech WebAccess/VPN < 1.1.5 SQL Injection via NetworksController.addNetworkAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34246

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34244

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxDeviceFwRulesAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34243

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxNetworkFwRulesAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34242

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34241

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34240

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34236

Advantech WebAccess/VPN < 1.1.5 Stored XSS via NetworksController.addNetworkAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34237

Advantech WebAccess/VPN < 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn