PlexTrac is a vulnerability management and reporting platform whose disclosure footprint concentrates in a single core product and skews strongly toward critical-severity outcomes. The recurring weakness classes—deserialization of untrusted data, path traversal, brute-force authentication bypass, file-path manipulation, and SQL injection—reflect the input-handling and state-management demands of a data-intensive web application. Defenders should prioritize patching this vendor's releases and restrict administrative access; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by PlexTrac, Inc. over time
Of all the CVEs published by PlexTrac, Inc. as a CNA, 100.0% affect products that PlexTrac, Inc. develops as a vendor.
Of all the CVEs published that affect products developed by PlexTrac, Inc., 72.7% are self-published by PlexTrac, Inc. as a CNA.
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-37144HIGH The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and | Sep 8, 2022 | 8.8 | 30 | NO | NO |
CVE-2024-11838CRITICAL External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 bef | Dec 13, 2024 | 9.8 | 27 | NO | NO |
CVE-2024-11837CRITICAL Improper Neutralization of Special Elements used in an N1QL Command ('N1QL Injection') vulnerability in PlexTrac allows N1QL Injection.This issue affects PlexTrac: from 1.61.3 bef | Dec 13, 2024 | 9.8 | 27 | NO | NO |
CVE-2024-12687CRITICAL Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.
This issue affects PlexTrac: from 1.61.3 be | Dec 16, 2024 | 9.8 | 26 | NO | NO |
CVE-2024-11834CRITICAL Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 befor | Dec 13, 2024 | 9.1 | 25 | NO | NO |
CVE-2024-11833CRITICAL Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 befor | Dec 13, 2024 | 9.1 | 25 | NO | NO |
CVE-2024-11836HIGH Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | Dec 13, 2024 | 7.5 | 22 | NO | NO |
CVE-2024-11835HIGH Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | Dec 13, 2024 | 7.5 | 21 | NO | NO |
CVE-2022-37146MEDIUM The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authenticat | Sep 8, 2022 | 5.3 | 21 | NO | NO |
CVE-2022-37145HIGH The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenti | Sep 8, 2022 | 7.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by PlexTrac, Inc..
Media articles that mention a CVE ID that affects a product developed by PlexTrac, Inc. — matched by CVE ID, not by vendor name.