Progress Whatsup Gold vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Progress Whatsup Gold: 7 record(s), with affected versions and fixes.
cpe:2.3:a:progress:whatsup_gold

CVE-2026-65941 High · 8.8 CWE-73 Aug 12, 2026

WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

CVE-2026-65940 Medium · 6.8 CWE-276 Aug 12, 2026

WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

CVE-2026-65939 Medium · 6.8 CWE-22 Aug 12, 2026

WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

CVE-2026-65938 Medium · 4.3 CWE-602 Aug 12, 2026

WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.

CVE-2026-65937 High · 8.0 CWE-94 Aug 12, 2026

WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.

CVE-2024-6670 Critical · 9.8 KEV Urgent · 90 Public exploit Ransomware CWE-89 Aug 29, 2024

Progress WhatsUp Gold SQL Injection Vulnerability

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

CVE-2024-4885 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-22 Jun 25, 2024

Progress WhatsUp Gold Path Traversal Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.