DevExpress

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

DevExpress records in CISA KEV

No DevExpress vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

6 records in Devexpress · all components

TI-2022-11328 CVE-2022-28684 · GHSA-cqm5-3ccf-cf57

MEDIUM 45

This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03754 Published 2022-08-03 No fix listed CWE-502

TI-2023-17901 CVE-2023-35817 · GHSA-5xhr-994v-5g9p

MEDIUM 43

DevExpress before 23.1.3 allows AsyncDownloader SSRF.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-04-28 Fixed in 21.2.12, 22 +4 CWE-918

TI-2023-17899 CVE-2023-35815 · GHSA-h4mr-59x2-64f9

MEDIUM 43

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-502

TI-2023-17898 CVE-2023-35814 · GHSA-84xx-9g7m-wh84

MEDIUM 43

DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00619 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-502

TI-2021-14777 CVE-2021-36483 · GHSA-h2qh-wp73-v6c9

MEDIUM 43

DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02923 Published 2021-08-04 No fix listed CWE-502

TI-2023-17900 CVE-2023-35816 · GHSA-22wj-vp2m-rxhc

LOW 25

DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00557 Published 2025-04-28 Fixed in 21.2.12, 22.1.7 +4 CWE-23