Skip to content

Vendor

Plunet vulnerabilities

4 published CVES affecting Plunet, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
2
Medium
1
Low
1
Unscored
0
CISA KEV
0
Atom feed of Plunet alerts

Products

Latest Plunet CVEs

Newest publication first

  1. CVE-2026-2344 Stored XSS on Plunet BusinessManager

    Published
    HighCVSS 8.6 EPSS 0.28%

    A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1

  2. CVE-2026-2337 Refleccted XSS on Plunet BusinessManager

    Published
    HighCVSS 8.7 EPSS 0.38%

    A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1.

  3. CVE-2009-0700 Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirA...

    Published
    MediumCVSS 4.0 EPSS 2.5%

    Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag...

  4. CVE-2009-0699 Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML vi...

    Published
    LowCVSS 3.5 EPSS 1.3%

    Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the (1) QUB and (2) Bez74 parameters.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.