彙總 plextrac 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 路徑處理缺陷與SQL 注入 等問題，部分漏洞可能導致 檔案覆寫，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2024-12687 | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 5fea7123-217b-4b2d-ada8-8892719b43cd | 8.6 | 0.62% | 2024-12-16 | 2026-06-17 |
| CVE-2024-11839 | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 5fea7123-217b-4b2d-ada8-8892719b43cd | 8.6 | 0.34% | 2024-12-13 | 2026-06-17 |
| CVE-2024-11838 | External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 5fea7123-217b-4b2d-ada8-8892719b43cd | 8.6 | 0.42% | 2024-12-13 | 2026-06-17 |
| CVE-2024-11837 | Improper Neutralization of Special Elements used in an N1QL Command ('N1QL Injection') vulnerability in PlexTrac allows N1QL Injection.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 5fea7123-217b-4b2d-ada8-8892719b43cd | 8.6 | 0.46% | 2024-12-13 | 2026-06-17 |
| CVE-2024-11836 | Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 5fea7123-217b-4b2d-ada8-8892719b43cd | 8.6 | 0.27% | 2024-12-13 | 2026-06-17 |
| CVE-2024-11835 | Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 5fea7123-217b-4b2d-ada8-8892719b43cd | 7.0 | 0.37% | 2024-12-13 | 2026-06-17 |
| CVE-2024-11834 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 5fea7123-217b-4b2d-ada8-8892719b43cd | 8.9 | 0.49% | 2024-12-13 | 2026-06-17 |
| CVE-2024-11833 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 5fea7123-217b-4b2d-ada8-8892719b43cd | 8.9 | 0.49% | 2024-12-13 | 2026-06-17 |
| CVE-2022-37146 | The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 | [email protected] | 5.3 | 0.67% | 2022-09-07 | 2026-07-04 |
| CVE-2022-37145 | The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider. | [email protected] | 7.5 | 0.86% | 2022-09-07 | 2026-07-04 |
| CVE-2022-37144 | The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user. | [email protected] | 8.8 | 0.79% | 2022-09-07 | 2026-07-04 |