stimulsoft records

9 published records for vendor stimulsoft.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 5
With a fix record: 33.3%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

9 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2020-15865No exploit	A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-6stimulsoft · reports · CWE-94 pre-auth RCE	Critical9.8	—	5.1%	Aug 18, 2020
40Plan	CVE-2024-24398Proof of concept	Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarystimulsoft · dashboards.php · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	2.0%	Feb 5, 2024
40Plan	CVE-2023-25261Proof of concept	Certain Stimulsoft GmbH products are affected by: Remote Code Execution.stimulsoft · designer · CWE-94 pre-auth RCE	Critical9.8	—	1.9%	Mar 27, 2023
39Monitor	CVE-2021-42777No exploit	Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any macstimulsoft · reports · CWE-209 pre-auth RCE Info leak	Critical9.8	—	1.1%	Oct 29, 2022
30Monitor	CVE-2023-25262Proof of concept	Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF).stimulsoft · designer · CWE-918 Pre-auth SSRF	High7.5	—	0.9%	Mar 27, 2023
30Monitor	CVE-2023-25260Proof of concept	Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.stimulsoft · designer · CWE-552 Pre-auth	High7.5	—	0.8%	Mar 28, 2023
24Monitor	CVE-2024-24396Proof of concept	Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarstimulsoft · dashboard.js · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.8%	Feb 5, 2024
22Monitor	CVE-2023-25263Proof of concept	In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrystimulsoft · designer · CWE-312	Medium5.5	—	0.2%	Mar 27, 2023
21Monitor	CVE-2024-24397Proof of concept	Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarstimulsoft · dashboards.js · CWE-79 RCE XSS	Medium5.4	—	0.7%	Feb 5, 2024

CVE-2020-15865
41Plan
A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-6
CriticalCVSS 9.8No exploitEPSS 5%
- pre-auth RCE
stimulsoft · reportsAug 18, 2020
CVE-2024-24398
40Plan
Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary
CriticalCVSS 9.8Proof of conceptEPSS 2%
- pre-auth RCE
- Path traversal
stimulsoft · dashboards.phpFeb 5, 2024
CVE-2023-25261
40Plan
Certain Stimulsoft GmbH products are affected by: Remote Code Execution.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
stimulsoft · designerMar 27, 2023
CVE-2021-42777
39Monitor
Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any mac
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Info leak
stimulsoft · reportsOct 29, 2022
CVE-2023-25262
30Monitor
Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF).
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- SSRF
stimulsoft · designerMar 27, 2023
CVE-2023-25260
30Monitor
Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
stimulsoft · designerMar 28, 2023
CVE-2024-24396
24Monitor
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrar
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
stimulsoft · dashboard.jsFeb 5, 2024
CVE-2023-25263
22Monitor
In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decry
MediumCVSS 5.5Proof of conceptEPSS 0%
stimulsoft · designerMar 27, 2023
CVE-2024-24397
21Monitor
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrar
MediumCVSS 5.4Proof of conceptEPSS 0%
- RCE
- XSS
stimulsoft · dashboards.jsFeb 5, 2024