https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-34247.htmlhttps://patchthecve.com/cve/CVE-2025-34247.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34246.htmlhttps://patchthecve.com/cve/CVE-2025-34246.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34245.htmlhttps://patchthecve.com/cve/CVE-2025-34245.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34244.htmlhttps://patchthecve.com/cve/CVE-2025-34244.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34243.htmlhttps://patchthecve.com/cve/CVE-2025-34243.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34242.htmlhttps://patchthecve.com/cve/CVE-2025-34242.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34241.htmlhttps://patchthecve.com/cve/CVE-2025-34241.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34240.htmlhttps://patchthecve.com/cve/CVE-2025-34240.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34239.htmlhttps://patchthecve.com/cve/CVE-2025-34239.htmlWed, 07 Oct 2026 21:10:00 +0000HIGH 7.2: Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.https://patchthecve.com/cve/CVE-2025-34238.htmlhttps://patchthecve.com/cve/CVE-2025-34238.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web uhttps://patchthecve.com/cve/CVE-2025-34237.htmlhttps://patchthecve.com/cve/CVE-2025-34237.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 5.4: Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the https://patchthecve.com/cve/CVE-2025-34236.htmlhttps://patchthecve.com/cve/CVE-2025-34236.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 5.4: Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's br