← Back

Plextrac

plextrac

11 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Plextrac
plextrac
11 CVEs

CVEs (11)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-12687
1Plextrac
1Plextrac
Oct 10, 2025
Dec 16, 2024
8.6 HIGH· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2024-11839
1Plextrac
1Plextrac
Oct 1, 2025
Dec 13, 2024
8.6 HIGH· v4
7.5 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2024-11838
1Plextrac
1Plextrac
Oct 1, 2025
Dec 13, 2024
8.6 HIGH· v4
9.8 CRITICAL· v3
N/A· v2
External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2024-11837
1Plextrac
1Plextrac
Oct 1, 2025
Dec 13, 2024
8.6 HIGH· v4
9.8 CRITICAL· v3
N/A· v2
Improper Neutralization of Special Elements used in an N1QL Command ('N1QL Injection') vulnerability in PlexTrac  allows N1QL Injection.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2024-11836
1Plextrac
1Plextrac
Oct 1, 2025
Dec 13, 2024
8.6 HIGH· v4
7.5 HIGH· v3
N/A· v2
Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2024-11835
1Plextrac
1Plextrac
Oct 1, 2025
Dec 13, 2024
7.0 HIGH· v4
7.5 HIGH· v3
N/A· v2
Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2024-11834
1Plextrac
1Plextrac
Oct 1, 2025
Dec 13, 2024
8.9 HIGH· v4
9.1 CRITICAL· v3
N/A· v2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2024-11833
1Plextrac
1Plextrac
Oct 1, 2025
Dec 13, 2024
8.9 HIGH· v4
9.1 CRITICAL· v3
N/A· v2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVE-2022-37146
1Plextrac
1Plextrac
Nov 21, 2024
Sep 8, 2022
N/A· v4
5.3 MEDIUM· v3
N/A· v2
The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid,...Show more
The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it impossible to distinguish between valid, locked user accounts and user accounts that do not exist, but does not prevent valid, unlocked users from being enumerated.Show less
CVE-2022-37145
1Plextrac
1Plextrac
Nov 21, 2024
Sep 8, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a br...Show more
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider.Show less
CVE-2022-37144
1Plextrac
1Plextrac
Nov 21, 2024
Sep 8, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past...Show more
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.Show less