TI-2023-09636 CVE-2023-23837 · GHSA-qhm5-6q48-xxp4
No Exception Handling Vulnerability: Database Performance Analyzer (DPA) 2023.1
Priority MEDIUM 40
No exception handling vulnerability which revealed sensitive or excessive information to users.
SolarWinds
Records350All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical82CVSS 9.0–10.0
CVSS high139CVSS 7.0–8.9
Exploited now
SolarWinds records in CISA KEVTI-2026-22619 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability TI-2025-19358 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability TI-2025-27034 SolarWinds Web Help Desk Security Control Bypass Vulnerability TI-2025-27044 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability TI-2024-19176 SolarWinds Web Help Desk Hardcoded Credential Vulnerability TI-2024-19175 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records in Database Performance Analyzer · all components
TI-2022-17819 CVE-2022-38112 · GHSA-hm3f-fwmw-7g2j
Sensitive information disclosure in SolarWinds Database Performance Analyzer
Priority LOW 39
In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.
TI-2018-13729 CVE-2018-19386 · GHSA-f57c-5gfr-jp86
SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS…
Priority LOW 39
SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iw…
TI-2021-14122 CVE-2021-35229 · GHSA-p9r2-fqqm-vvrr
Cross-Site Scripting Vulnerability using SQL Query
Priority LOW 36
Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query
TI-2023-09637 CVE-2023-23838 · GHSA-jg2w-28qh-4f7h
Directory traversal and file enumeration vulnerability: Database Performance Analyzer (DPA) 2023.1
Priority LOW 31
Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server.
TI-2025-19357 CVE-2025-26398 · GHSA-wmch-r6fm-gmwh
SolarWinds Database Performance Analyzer Hard-coded Cryptographic Key Vulnerability
Priority LOW 30
SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key.
TI-2023-16405 CVE-2023-33231 · GHSA-w9jr-jx8g-86rc
XSS in SolarWinds Database Performance Analyzer 2023.2
Priority LOW 28
XSS attack was possible in DPA 2023.2 due to insufficient input validation
TI-2018-11631 CVE-2018-16243 · GHSA-m4hr-5jvh-hpgq
SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several…
Priority LOW 27
SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, e…
TI-2021-14121 CVE-2021-35228 · GHSA-j8cq-p5c8-344h
Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388
Priority LOW 26
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack.
TI-2022-17817 CVE-2022-38110 · GHSA-cjjr-xfg9-m332
Reflected cross-site scripting in SolarWinds Database Performance Analyzer
Priority LOW 25
In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting.