Home / CVEs
Exploited vulnerabilities (CISA KEV)
CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.
CVE-2018-19410
Critical · 9.8
KEV Urgent · 73 Public exploit Nov 21, 2018
Paessler PRTG Network Monitor Local File Inclusion Vulnerability
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
CVE-2018-9276
High · 7.2
KEV Urgent · 76 Public exploit CWE-78 Jul 2, 2018
Paessler PRTG Network Monitor OS Command Injection Vulnerability
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.