Progress Software vulnerabilities

CVE-2025-11906 Medium · 6.7 CWE-732 Oct 30, 2025

Privilege escalation via writable configuration files in Progress Flowmon

A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.

CVE-2025-10240 High · 8.8 CWE-79 Oct 9, 2025

Possibility of unintended actions when a user clicks a malicious link in the Progress Flowmon web application

A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated session.

CVE-2025-10239 High · 7.2 CWE-78 Oct 9, 2025

Unintended command execution via troubleshooting scripts in Progress Flowmon

In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes.

CVE-2025-8868 High · 8.8 Public exploit CWE-89 Sep 29, 2025

Chef Automate compliance service SQL Injection Vulnerability

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.

CVE-2025-6724 High · 8.8 CWE-89 Sep 29, 2025

Chef Automate SQL Injection Vulnerability

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.

CVE-2024-6670 Critical · 9.8 KEV Urgent · 90 Public exploit Ransomware CWE-89 Aug 29, 2024

Progress WhatsUp Gold SQL Injection Vulnerability

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

CVE-2024-4885 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-22 Jun 25, 2024

Progress WhatsUp Gold Path Traversal Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

CVE-2024-4358 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-290 May 29, 2024

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

CVE-2024-1212 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-78 Feb 21, 2024

Progress Kemp LoadMaster OS Command Injection Vulnerability

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

CVE-2023-40044 High · 8.8 KEV Urgent · 89 Public exploit Ransomware CWE-502 Sep 27, 2023

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.