https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-52694.htmlhttps://patchthecve.com/cve/CVE-2025-52694.htmlWed, 17 Jun 2026 09:36:54 +0000CRITICAL 10.0: Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators https://patchthecve.com/cve/CVE-2025-67653.htmlhttps://patchthecve.com/cve/CVE-2025-67653.htmlWed, 17 Jun 2026 09:57:59 +0000MEDIUM 4.3: Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files.https://patchthecve.com/cve/CVE-2025-46268.htmlhttps://patchthecve.com/cve/CVE-2025-46268.htmlWed, 17 Jun 2026 09:26:07 +0000MEDIUM 6.3: Advantech WebAccess/SCADA  is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands.https://patchthecve.com/cve/CVE-2025-14850.htmlhttps://patchthecve.com/cve/CVE-2025-14850.htmlWed, 17 Jun 2026 08:36:39 +0000HIGH 8.1: Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.https://patchthecve.com/cve/CVE-2025-14849.htmlhttps://patchthecve.com/cve/CVE-2025-14849.htmlWed, 30 Sep 2026 23:10:00 +0000HIGH 8.8: Advantech WebAccess/SCADA  is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.https://patchthecve.com/cve/CVE-2025-14848.htmlhttps://patchthecve.com/cve/CVE-2025-14848.htmlWed, 17 Jun 2026 08:36:38 +0000MEDIUM 4.3: Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.https://patchthecve.com/cve/CVE-2025-34266.htmlhttps://patchthecve.com/cve/CVE-2025-34266.htmlThu, 15 Oct 2026 21:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/addins/menus endpoint. When an authenticated user adds or edits an AddIns menu entry, the label and path values are stored in plugin configuration data and latehttps://patchthecve.com/cve/CVE-2025-34265.htmlhttps://patchthecve.com/cve/CVE-2025-34265.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an authenticated user creates or updates a rule for an agent, the rule fields min, max, and unit are stored and later rendered in rule listings orhttps://patchthecve.com/cve/CVE-2025-34264.htmlhttps://patchthecve.com/cve/CVE-2025-34264.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint. When an authenticated user adds or edits Software Watchdog process rules for an agent, the monitored process name is stored in the settings array and https://patchthecve.com/cve/CVE-2025-34263.htmlhttps://patchthecve.com/cve/CVE-2025-34263.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds or edits a dashboard entry, the label and path values are stored in plugin configuration data and lathttps://patchthecve.com/cve/CVE-2025-34262.htmlhttps://patchthecve.com/cve/CVE-2025-34262.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agent_id} endpoint. When an authenticated user renames a device, the new_name value is stored and later rendered in device listings or detail views without prophttps://patchthecve.com/cve/CVE-2025-34261.htmlhttps://patchthecve.com/cve/CVE-2025-34261.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint. When an authenticated user creates a device group, the name and description values are stored and later rendered in device group listings without prophttps://patchthecve.com/cve/CVE-2025-34260.htmlhttps://patchthecve.com/cve/CVE-2025-34260.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint. When an authenticated user adds a schedule to an existing task, the schedule name is stored and later rendered in schedule listings without HTML sanhttps://patchthecve.com/cve/CVE-2025-34259.htmlhttps://patchthecve.com/cve/CVE-2025-34259.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When an authenticated user creates a map entry, the name parameter is stored and later rendered in the map list UI without HTML sanitzation. An ahttps://patchthecve.com/cve/CVE-2025-34258.htmlhttps://patchthecve.com/cve/CVE-2025-34258.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint. When an authenticated user adds an area to a map entry, the name parameter is stored and later rendered in the map list without HTML sanitization. Anhttps://patchthecve.com/cve/CVE-2025-34257.htmlhttps://patchthecve.com/cve/CVE-2025-34257.htmlFri, 25 Sep 2026 23:10:00 +0000MEDIUM 5.4: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the defined_name value is stored and later rendered in the Overview page without HTML sanitization. An atthttps://patchthecve.com/cve/CVE-2025-34256.htmlhttps://patchthecve.com/cve/CVE-2025-34256.htmlWed, 17 Jun 2026 09:13:45 +0000CRITICAL 9.8: Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unhttps://patchthecve.com/cve/CVE-2025-63701.htmlhttps://patchthecve.com/cve/CVE-2025-63701.htmlWed, 17 Jun 2026 09:53:23 +0000MEDIUM 6.8: A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called with a valid dmDriverExtra value but an undersized output buffer. The driver incorrectly assumes the output buffer size matches the input buhttps://patchthecve.com/cve/CVE-2025-64302.htmlhttps://patchthecve.com/cve/CVE-2025-64302.htmlWed, 17 Jun 2026 09:54:10 +0000MEDIUM 6.4: Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation.https://patchthecve.com/cve/CVE-2025-62630.htmlhttps://patchthecve.com/cve/CVE-2025-62630.htmlWed, 07 Oct 2026 21:10:00 +0000HIGH 8.8: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.https://patchthecve.com/cve/CVE-2025-59171.htmlhttps://patchthecve.com/cve/CVE-2025-59171.htmlWed, 07 Oct 2026 21:10:00 +0000HIGH 7.5: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.https://patchthecve.com/cve/CVE-2025-58423.htmlhttps://patchthecve.com/cve/CVE-2025-58423.htmlWed, 07 Oct 2026 21:10:00 +0000HIGH 8.8: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account.https://patchthecve.com/cve/CVE-2025-34247.htmlhttps://patchthecve.com/cve/CVE-2025-34247.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34246.htmlhttps://patchthecve.com/cve/CVE-2025-34246.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34245.htmlhttps://patchthecve.com/cve/CVE-2025-34245.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34244.htmlhttps://patchthecve.com/cve/CVE-2025-34244.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34243.htmlhttps://patchthecve.com/cve/CVE-2025-34243.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34242.htmlhttps://patchthecve.com/cve/CVE-2025-34242.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34241.htmlhttps://patchthecve.com/cve/CVE-2025-34241.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34240.htmlhttps://patchthecve.com/cve/CVE-2025-34240.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.https://patchthecve.com/cve/CVE-2025-34239.htmlhttps://patchthecve.com/cve/CVE-2025-34239.htmlWed, 07 Oct 2026 21:10:00 +0000HIGH 7.2: Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.https://patchthecve.com/cve/CVE-2025-34238.htmlhttps://patchthecve.com/cve/CVE-2025-34238.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 6.5: Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web uhttps://patchthecve.com/cve/CVE-2025-34237.htmlhttps://patchthecve.com/cve/CVE-2025-34237.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 5.4: Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the https://patchthecve.com/cve/CVE-2025-34236.htmlhttps://patchthecve.com/cve/CVE-2025-34236.htmlWed, 07 Oct 2026 21:10:00 +0000MEDIUM 5.4: Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's brhttps://patchthecve.com/cve/CVE-2022-50595.htmlhttps://patchthecve.com/cve/CVE-2022-50595.htmlWed, 17 Jun 2026 05:23:51 +0000HIGH 7.2: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_search_value’ parameter to the ‘NetworkServlet’ endpoint. Successful ehttps://patchthecve.com/cve/CVE-2022-50594.htmlhttps://patchthecve.com/cve/CVE-2022-50594.htmlWed, 17 Jun 2026 05:23:51 +0000HIGH 7.5: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘data’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation https://patchthecve.com/cve/CVE-2022-50593.htmlhttps://patchthecve.com/cve/CVE-2022-50593.htmlWed, 17 Jun 2026 05:23:51 +0000CRITICAL 9.8: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the ‘NetworkServlet’ endpoint. Successful exploihttps://patchthecve.com/cve/CVE-2022-50592.htmlhttps://patchthecve.com/cve/CVE-2022-50592.htmlWed, 17 Jun 2026 05:23:51 +0000HIGH 7.2: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘getInventoryReportData’ parameter to the ‘NetworkServlet’ endpoint. Succeshttps://patchthecve.com/cve/CVE-2022-50591.htmlhttps://patchthecve.com/cve/CVE-2022-50591.htmlWed, 17 Jun 2026 05:23:51 +0000CRITICAL 9.8: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_config_id’ parameter to the ‘NetworkServlet’ endpoint. Successful explhttps://patchthecve.com/cve/CVE-2025-53519.htmlhttps://patchthecve.com/cve/CVE-2025-53519.htmlWed, 17 Jun 2026 09:38:22 +0000MEDIUM 5.4: A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating specific parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosurehttps://patchthecve.com/cve/CVE-2025-53515.htmlhttps://patchthecve.com/cve/CVE-2025-53515.htmlWed, 17 Jun 2026 09:38:21 +0000HIGH 8.8: A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitized, allowing an attacker to perform Shttps://patchthecve.com/cve/CVE-2025-53509.htmlhttps://patchthecve.com/cve/CVE-2025-53509.htmlWed, 17 Jun 2026 09:38:21 +0000MEDIUM 6.5: A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used directly in a command without proper sanitization, allowing arbihttps://patchthecve.com/cve/CVE-2025-53475.htmlhttps://patchthecve.com/cve/CVE-2025-53475.htmlWed, 17 Jun 2026 09:38:16 +0000HIGH 8.8: A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not properly sanitized, allohttps://patchthecve.com/cve/CVE-2025-53397.htmlhttps://patchthecve.com/cve/CVE-2025-53397.htmlWed, 17 Jun 2026 09:38:08 +0000MEDIUM 5.4: A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting this flaw, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other mahttps://patchthecve.com/cve/CVE-2025-52577.htmlhttps://patchthecve.com/cve/CVE-2025-52577.htmlWed, 17 Jun 2026 09:36:42 +0000HIGH 8.8: A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly sanitized, allowing an attackhttps://patchthecve.com/cve/CVE-2025-48891.htmlhttps://patchthecve.com/cve/CVE-2025-48891.htmlWed, 17 Jun 2026 09:30:26 +0000HIGH 7.6: A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulnerability can be exploited by an authenticated attacker with at least user-level privileges, potentially leading to information disclosure or a denial-of-servicehttps://patchthecve.com/cve/CVE-2025-46704.htmlhttps://patchthecve.com/cve/CVE-2025-46704.htmlWed, 17 Jun 2026 09:26:50 +0000MEDIUM 4.3: A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This issue requires an authenticated attacker with at least user-level privileges. A specific parameter is not properly sanitized or normalized, potentially allowhttps://patchthecve.com/cve/CVE-2025-41442.htmlhttps://patchthecve.com/cve/CVE-2025-41442.htmlWed, 17 Jun 2026 09:22:52 +0000MEDIUM 5.4: A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclhttps://patchthecve.com/cve/CVE-2025-48470.htmlhttps://patchthecve.com/cve/CVE-2025-48470.htmlWed, 17 Jun 2026 09:29:40 +0000MEDIUM 4.1: Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation.https://patchthecve.com/cve/CVE-2025-48469.htmlhttps://patchthecve.com/cve/CVE-2025-48469.htmlWed, 17 Jun 2026 09:29:40 +0000CRITICAL 9.6: Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation.