Vulnerabilities

TI-2025-19357 CVE-2025-26398 · GHSA-wmch-r6fm-gmwh

SolarWinds Database Performance Analyzer Hard-coded Cryptographic Key Vulnerability

LOW 30

SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.002 Published 2025-08-12 No fix listed CWE-798

TI-2023-16405 CVE-2023-33231 · GHSA-w9jr-jx8g-86rc

XSS in SolarWinds Database Performance Analyzer 2023.2

LOW 28

XSS attack was possible in DPA 2023.2 due to insufficient input validation

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00502 Published 2023-07-18 No fix listed CWE-79

TI-2023-09637 CVE-2023-23838 · GHSA-jg2w-28qh-4f7h

Directory traversal and file enumeration vulnerability: Database Performance Analyzer (DPA) 2023.1

LOW 31

Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01272 Published 2023-04-25 No fix listed CWE-22

TI-2023-09636 CVE-2023-23837 · GHSA-qhm5-6q48-xxp4

No Exception Handling Vulnerability: Database Performance Analyzer (DPA) 2023.1

MEDIUM 40

No exception handling vulnerability which revealed sensitive or excessive information to users.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00809 Published 2023-04-25 No fix listed CWE-209

TI-2022-17819 CVE-2022-38112 · GHSA-hm3f-fwmw-7g2j

Sensitive information disclosure in SolarWinds Database Performance Analyzer

LOW 39

In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00427 Published 2023-01-20 No fix listed CWE-312

TI-2022-17817 CVE-2022-38110 · GHSA-cjjr-xfg9-m332

Reflected cross-site scripting in SolarWinds Database Performance Analyzer

LOW 25

In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00413 Published 2023-01-20 No fix listed CWE-79

TI-2021-14122 CVE-2021-35229 · GHSA-p9r2-fqqm-vvrr

Cross-Site Scripting Vulnerability using SQL Query

LOW 36

Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.03194 Published 2022-04-21 Fixed in 2022.1 CWE-79

TI-2021-14121 CVE-2021-35228 · GHSA-j8cq-p5c8-344h

Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388

LOW 26

This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00577 Published 2021-10-21 Fixed in 2021.3.7388 CWE-79

TI-2018-11631 CVE-2018-16243 · GHSA-m4hr-5jvh-hpgq

SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several…

LOW 27

SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, e…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01376 Published 2020-12-15 No fix listed CWE-79

TI-2018-13729 CVE-2018-19386 · GHSA-f57c-5gfr-jp86

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS…

LOW 39

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iw…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.09044 Published 2019-08-14 No fix listed CWE-79

Vulnerabilities

Filters