Sangfor

CVE-2026-1324 Jan 22, 15:16 HIGH POC This Week

Operation And Maintenance Security Management System versions up to 3.0.12. is affected by command injection (CVSS 8.8).

CVE-2026-1414 Jan 26, 03:15 LOW POC Monitor

Operation And Maintenance Security Management System versions up to 3.0.12. contains a vulnerability that allows attackers to command injection (CVSS 6.3).

CVE-2026-1413 Jan 26, 02:15 LOW Monitor

Operation And Maintenance Security Management System versions up to 3.0.12. contains a security vulnerability (CVSS 6.3).

CVE-2026-1412 Jan 26, 01:15 MEDIUM POC This Month

Operation And Maintenance Security Management System versions up to 3.0.12. contains a security vulnerability (CVSS 7.3).

CVE-2026-1325 Jan 22, 15:16 MEDIUM POC This Month

Operation And Maintenance Security Management System versions up to 3.0.12. is affected by weak password recovery mechanism for forgotten password (CVSS 5.3).

CVE-2025-15503 Jan 10, 09:15 MEDIUM POC This Month

Operation And Maintenance Security Management System versions up to 3.0.8. is affected by improper access control (CVSS 7.3).

CVE-2025-15502 Jan 10, 08:15 MEDIUM POC This Month

Operation And Maintenance Security Management System versions up to 3.0.8. is affected by command injection (CVSS 7.3).

CVE-2025-15501 Jan 09, 23:15 CRITICAL POC Act Now

Sangfor O&M Management System (through 3.0.8) has a second command injection in /isomp-protocol/protocol/getCmd, also via sessionPath. Public exploit with higher EPSS (1.2%) than the first vulnerability.

CVE-2025-15500 Jan 09, 22:15 CRITICAL POC Act Now

Sangfor Operation and Maintenance Management System (through 3.0.8) has OS command injection in /isomp-protocol/protocol/getHis via the sessionPath parameter. Public exploit available, vendor unresponsive.

CVE-2025-15499 Jan 09, 22:15 HIGH POC This Week

Operation And Maintenance Management System versions up to 3.0.8. is affected by command injection (CVSS 8.8).

CVE-2025-12916 Nov 09, 00:15 LOW POC Monitor

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-5129 May 24, 17:15 HIGH POC This Month

A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Rated high severity (CVSS 7.3). Public exploit code available and no vendor patch available.

CVE-2023-30806 Oct 10, 15:15 CRITICAL POC THREAT Act Now

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-30805 Oct 10, 15:15 CRITICAL POC THREAT Act Now

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-30804 Oct 10, 15:15 MEDIUM POC THREAT This Month

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-30803 Oct 10, 15:15 CRITICAL POC THREAT Act Now

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-30802 Oct 10, 15:15 MEDIUM POC This Month

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-22908 Feb 26, 22:15 MEDIUM POC This Month

SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents of the Username and Password fields. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.