Approved changes feed: RSS · Atom
cpe:2.3:a:proget:proget:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Proget (c9544a68-1be1-5675-b395-b27abfd476cc) |
|---|---|
| Product | Proget (32b59841-8274-5eec-a7a0-d7252f629856) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-1421 |
vulnerable | 2026-06-08 07:08:36.778168 |
Formula injection in a CSV file in Proget MDM
Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.
This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Published: 2025-05-21T13:04:37.497Z
Updated: 2025-05-21T13:24:04.623Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1420 |
vulnerable | 2026-06-08 07:08:36.777787 |
XSS in Proget MDM
Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.
This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Published: 2025-05-21T13:04:23.644Z
Updated: 2025-05-21T13:24:17.340Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1419 |
vulnerable | 2026-06-08 07:08:36.777408 |
XSS in Proget MDM
Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.
This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Published: 2025-05-21T13:03:56.937Z
Updated: 2025-05-21T13:25:12.684Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1418 |
vulnerable | 2026-06-08 07:08:36.777128 |
Information disclosure in Proget MDM
A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive information (including their usage in connected devices).
This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Published: 2025-05-21T13:03:44.656Z
Updated: 2025-05-21T13:26:07.661Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1417 |
vulnerable | 2026-06-08 07:08:36.776831 |
Information disclosure in Proget MDM
In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of CVE-2025-1416.
Successful exploitation requires UUID of a targeted backup, which cannot be brute forced.
This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Published: 2025-05-21T13:03:35.249Z
Updated: 2025-05-21T13:30:21.030Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1416 |
vulnerable | 2026-06-08 07:08:36.776409 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1415 |
vulnerable | 2026-06-08 07:08:36.775891 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.