Threat database

In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification.

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.

CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.

CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

CVE-2026-5174 is an improper input validation vulnerability in Progress Software MOVEit Automation that allows privilege escalation. It affects multiple versions of MOVEit Automation released from 2024.0.0 up to versions prior to 2025.1.5. The vulnerability has a high severity rating with a CVSS score of 7.7. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.

CVE-2026-4670 is a critical authentication bypass vulnerability in Progress Software MOVEit Automation affecting versions from 2024.0.0 before 2024.1.8 and from 2025.0.0 before 2025.0.9. This vulnerability allows an attacker to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.

CVE-2026-6022 is a high-severity vulnerability in Progress Software's Telerik UI for ASP. NET AJAX prior to version 2026.1.421. The RadAsyncUpload component improperly enforces file upload size limits during chunk reassembly, allowing attackers to upload files exceeding the configured maximum size. This uncontrolled resource consumption can lead to disk space exhaustion on the affected system. There is no official patch or remediation level currently confirmed. No known exploits are reported in the wild. The vulnerability impacts availability but does not affect confidentiality or integrity.

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command

CVE-2026-3518 is a high-severity OS command injection vulnerability in the API of Progress Software LoadMaster version 7.2.37.0. It allows an authenticated attacker with full permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command. The vulnerability requires authentication with high privileges and does not involve user interaction. No official patch or remediation guidance has been published yet.

CVE-2026-3517 is a high-severity OS command injection vulnerability in Progress Software LoadMaster version 7.1.32.0. It affects the API component of the product, allowing an authenticated attacker with 'Geo Administration' permissions to execute arbitrary commands on the LoadMaster appliance. The vulnerability arises from unsanitized input in the 'addcountry' command. There is no official patch or remediation level currently confirmed by the vendor. No known exploits are reported in the wild at this time.