traccar records

15 published records for vendor traccar.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 1 · 6.7%
Pre-auth RCE: 3
With a fix record: 46.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

15 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
60This week	CVE-2024-31214Weaponized	Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code executiontraccar · traccar · CWE-434 pre-auth RCE File upload XSS	Critical9.6	—	17.6%	Apr 10, 2024
40Plan	CVE-2018-1000881No exploit	Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability intraccar · server · CWE-94 pre-auth RCE	Critical9.8	—	3.8%	Dec 20, 2018
40Plan	CVE-2019-5748No exploit	In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.traccar · server · CWE-611 Pre-auth XXE	Critical9.8	—	1.7%	Jan 9, 2019
39Monitor	CVE-2023-50729No exploit	An unrestricted file upload vulnerability in traccar leads to RCEtraccar · traccar · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.6%	Jan 15, 2024
38Monitor	CVE-2024-7746No exploit	Use of default credentials at Traccar fleet management solutiontraccar · traccar · CWE-1392 Pre-auth Hard-coded credentials	Critical9.5	—	0.5%	Aug 13, 2024
34Monitor	CVE-2026-25648No exploit	Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Uploadtraccar · traccar · CWE-79 RCE XSS	High8.7	—	0.3%	Feb 23, 2026
34Monitor	CVE-2026-25649No exploit	Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpointstraccar · traccar · CWE-352 CSRF Open redirect	High8.7	—	0.1%	Feb 23, 2026
26Monitor	CVE-2020-5246No exploit	LDAP injection vulnerability in Traccar GPS Tracking Systemtraccar · traccar · CWE-90	Medium6.5	—	0.8%	Jul 14, 2020
26Monitor	CVE-2025-68930Proof of concept	Traccar Missing Origin Validation in WebSocketstraccar · traccar · CWE-1385 Pre-auth	Medium6.5	—	0.5%	Feb 23, 2026
26Monitor	CVE-2026-27644No exploit	traccar allows CSV formula injection via exported position datatraccar · traccar · CWE-1236 RCE	Medium6.5	—	0.3%	May 5, 2026
26Monitor	CVE-2026-23521No exploit	Traccar vulnerable to Path Traversal and External Control of File Name or Pathtraccar · traccar · CWE-22 Path traversal	Medium6.5	—	0.3%	Feb 23, 2026
25Monitor	CVE-2021-21292No exploit	Unquoted Windows binary path in Traccartraccar · traccar · CWE-428 Local privilege escalation	Medium6.3	—	0.3%	Feb 2, 2021
21Monitor	CVE-2026-27693No exploit	traccar allows XML injection in KML and GPX exportstraccar · traccar · CWE-91	Medium5.4	—	0.2%	May 5, 2026
21Monitor	CVE-2026-44314No exploit	Traccar: Missing edit authorization on device image upload allows read-only users to write filestraccar · traccar · CWE-863 Broken access control (IDOR)	Medium5.3	—	0.2%	May 26, 2026
21Monitor	CVE-2026-27694No exploit	traccar allows stored HTML injection in notification emailstraccar · traccar · CWE-79 XSS	Medium5.4	—	0.2%	May 5, 2026

CVE-2024-31214
60This week
Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution
CriticalCVSS 9.6WeaponizedEPSS 17%
traccar · traccarApr 10, 2024
CVE-2018-1000881
40Plan
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in
CriticalCVSS 9.8No exploitEPSS 3%
- pre-auth RCE
traccar · serverDec 20, 2018
CVE-2019-5748
40Plan
In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- XXE
traccar · serverJan 9, 2019
CVE-2023-50729
39Monitor
An unrestricted file upload vulnerability in traccar leads to RCE
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
traccar · traccarJan 15, 2024
CVE-2024-7746
38Monitor
Use of default credentials at Traccar fleet management solution
CriticalCVSS 9.5No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
traccar · traccarAug 13, 2024
CVE-2026-25648
34Monitor
Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
traccar · traccarFeb 23, 2026
CVE-2026-25649
34Monitor
Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints
HighCVSS 8.7No exploitEPSS 0%
- CSRF
- Open redirect
traccar · traccarFeb 23, 2026
CVE-2020-5246
26Monitor
LDAP injection vulnerability in Traccar GPS Tracking System
MediumCVSS 6.5No exploitEPSS 0%
traccar · traccarJul 14, 2020
CVE-2025-68930
26Monitor
Traccar Missing Origin Validation in WebSockets
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
traccar · traccarFeb 23, 2026
CVE-2026-27644
26Monitor
traccar allows CSV formula injection via exported position data
MediumCVSS 6.5No exploitEPSS 0%
- RCE
traccar · traccarMay 5, 2026
CVE-2026-23521
26Monitor
Traccar vulnerable to Path Traversal and External Control of File Name or Path
MediumCVSS 6.5No exploitEPSS 0%
- Path traversal
traccar · traccarFeb 23, 2026
CVE-2021-21292
25Monitor
Unquoted Windows binary path in Traccar
MediumCVSS 6.3No exploitEPSS 0%
- Local privilege escalation
traccar · traccarFeb 2, 2021
CVE-2026-27693
21Monitor
traccar allows XML injection in KML and GPX exports
MediumCVSS 5.4No exploitEPSS 0%
traccar · traccarMay 5, 2026
CVE-2026-44314
21Monitor
Traccar: Missing edit authorization on device image upload allows read-only users to write files
MediumCVSS 5.3No exploitEPSS 0%
- Broken access control (IDOR)
traccar · traccarMay 26, 2026
CVE-2026-27694
21Monitor
traccar allows stored HTML injection in notification emails
MediumCVSS 5.4No exploitEPSS 0%
- XSS
traccar · traccarMay 5, 2026