Flowmon
Monthly
Privilege escalation via incorrect authorization in Progress Flowmon lets an authenticated low-privileged user abuse the PDF generation workflow to have operations executed under another user's identity, exposing sensitive data and permitting unauthorized configuration changes. It affects all Flowmon releases before 12.5.9 (12.x branch) and before 13.0.10 (13.x branch). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High).
Progress Flowmon 12.x and 13.0.x contain a cross-site scripting (XSS) vulnerability allowing authenticated attackers to execute malicious JavaScript in administrator sessions via crafted links. Affected versions: Flowmon 12.x prior to 12.5.8 and 13.x prior to 13.0.6. CVSS 8.5 (High) reflects network-based delivery with low complexity requiring privileged access and user interaction. EPSS score of 0.05% (15th percentile) indicates minimal observed exploitation activity. No active exploitation confirmed (not in CISA KEV); SSVC designates exploitation status as 'none' with non-automatable attack requiring user interaction for total technical impact. Vendor Progress Software released patches addressing the XSS flaw.
Progress Flowmon versions prior to 12.5.8 allow authenticated low-privileged users to execute arbitrary commands on the server by crafting malicious requests during the report generation process. The vulnerability stems from improper input validation in the report generation functionality, enabling command injection attacks. While no CVSS score or public exploit code has been disclosed at time of analysis, the direct path to remote code execution via an authenticated user represents a significant risk to Flowmon deployments.
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection flaw in the Progress Flowmon management interface lets an authenticated administrator abuse the built-in troubleshooting scripts feature to run additional unintended commands on the underlying system. Only Flowmon deployments prior to 12.5.5 are affected, and exploitation requires network reachability to the management interface plus a valid administrator-level account, so the realistic exposure is limited to malicious insiders, compromised or stolen admin credentials, or chaining from a separate access-gaining vulnerability. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is low at roughly 0.38% (30th percentile), making this a high-CVSS but gated, post-authentication issue rather than a mass-exploitation priority.
Privilege escalation via incorrect authorization in Progress Flowmon lets an authenticated low-privileged user abuse the PDF generation workflow to have operations executed under another user's identity, exposing sensitive data and permitting unauthorized configuration changes. It affects all Flowmon releases before 12.5.9 (12.x branch) and before 13.0.10 (13.x branch). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High).
Progress Flowmon 12.x and 13.0.x contain a cross-site scripting (XSS) vulnerability allowing authenticated attackers to execute malicious JavaScript in administrator sessions via crafted links. Affected versions: Flowmon 12.x prior to 12.5.8 and 13.x prior to 13.0.6. CVSS 8.5 (High) reflects network-based delivery with low complexity requiring privileged access and user interaction. EPSS score of 0.05% (15th percentile) indicates minimal observed exploitation activity. No active exploitation confirmed (not in CISA KEV); SSVC designates exploitation status as 'none' with non-automatable attack requiring user interaction for total technical impact. Vendor Progress Software released patches addressing the XSS flaw.
Progress Flowmon versions prior to 12.5.8 allow authenticated low-privileged users to execute arbitrary commands on the server by crafting malicious requests during the report generation process. The vulnerability stems from improper input validation in the report generation functionality, enabling command injection attacks. While no CVSS score or public exploit code has been disclosed at time of analysis, the direct path to remote code execution via an authenticated user represents a significant risk to Flowmon deployments.
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection flaw in the Progress Flowmon management interface lets an authenticated administrator abuse the built-in troubleshooting scripts feature to run additional unintended commands on the underlying system. Only Flowmon deployments prior to 12.5.5 are affected, and exploitation requires network reachability to the management interface plus a valid administrator-level account, so the realistic exposure is limited to malicious insiders, compromised or stolen admin credentials, or chaining from a separate access-gaining vulnerability. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is low at roughly 0.38% (30th percentile), making this a high-CVSS but gated, post-authentication issue rather than a mass-exploitation priority.