Aggregates CVE and security vulnerability intelligence across all devexpress-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk path handling and vendor risk ssrf, with potential vendor impact file overwrite across vendor surface software deployment and vendor surface production workloads use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2023-35817 | DevExpress before 23.1.3 allows AsyncDownloader SSRF. | [email protected] | 5.0 | 0.27% | 2025-04-28 | 2026-06-17 |
| CVE-2023-35816 | DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. | [email protected] | 3.5 | 0.38% | 2025-04-28 | 2026-06-17 |
| CVE-2023-35815 | DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. | [email protected] | 3.5 | 0.39% | 2025-04-28 | 2026-06-17 |
| CVE-2023-35814 | DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. | [email protected] | 3.5 | 0.39% | 2025-04-28 | 2026-06-17 |
| CVE-2022-41479 | The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which allows attackers to access the application source code. NOTE: the vendor disputes this because the retrieved source code is only the DevExpress client-side application code that is, of course, intentionally readable by web browsers (a site's | [email protected] | 7.5 | 1.10% | 2022-10-18 | 2026-06-17 |
| CVE-2022-28684 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710. | [email protected] | 8.8 | 2.49% | 2022-08-03 | 2026-06-17 |
| CVE-2021-36483 | DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. | [email protected] | 8.8 | 2.90% | 2021-08-04 | 2026-06-16 |
| CVE-2015-4670 | Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd. | [email protected] | 6.4 | 1.91% | 2015-08-18 | 2026-06-16 |
| CVE-2014-2575 | Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter. | [email protected] | 6.5 | 7.33% | 2014-06-06 | 2026-06-16 |