AcewareCVEs & Vulnerabilities

5 CVEs affecting Aceware products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.

5 CVEs→ All vendors

Most Affected Products

aceweb online portal 5

CVE-2022-24581HIGH

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.

ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.

2 Jun 2022

7.5

CVSS

CVE-2022-24240CRITICAL

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp.

2 Jun 2022

9.8

CVSS

CVE-2022-24239CRITICAL

ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp.

2 Jun 2022

9.8