Webpagetest is a web performance analysis and monitoring tool used to measure and diagnose site load times and user-experience metrics, with its vulnerability exposure concentrated in the primary webpagetest product. The durable signal centers on application-layer boundary issues: path-traversal flaws and server-side request forgery conditions that reflect the tool's need to fetch and analyze external web content. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Webpagetest over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-17199HIGH www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.j | Oct 5, 2019 | 7.5 | 40 | NO | YES |
CVE-2019-12161HIGH WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168). | May 17, 2019 | 8.8 | 28 | NO | NO |
CVE-2017-6541MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (benchmark, time) pass | Mar 8, 2017 | 6.1 | 22 | NO | NO |
CVE-2017-6536MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (url, pssid) passed to | Mar 8, 2017 | 6.1 | 22 | NO | NO |
CVE-2017-6540MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (configs) passed to th | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6539MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (benchmark, time) pass | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6538MEDIUM A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (video) passed to the webpagetes | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6537MEDIUM A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (bgcolor) passed to the webpaget | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6535MEDIUM Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (benchmark, url) passe | Mar 8, 2017 | 6.1 | 17 | NO | NO |
CVE-2017-6534MEDIUM A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (pssid) passed to the webpagetes | Mar 8, 2017 | 6.1 | 17 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Webpagetest.
Media articles that mention a CVE ID that affects a product developed by Webpagetest — matched by CVE ID, not by vendor name.