What’s Vulnerable › Vulnerabilities

CVE-2015-4027

• Severity: high (CVSS 7.2 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-12-17 · updated 2026-06-17
• Weakness: CWE-264

Description

The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges via a command parameter in the reporttemplate property in a params JSON object to api/addScan.

Affected products

• Acunetix Web Vulnerability Scanner: through 10

References

• http://packetstormsecurity.com/files/134602/Acunetix-WVS-10-Local-Privilege-Escalation.html
• https://www.acunetix.com/blog/releases/acunetix-10-build-includes-security-checks-in-cors-configurations/
• https://www.exploit-db.com/exploits/38847/
• http://packetstormsecurity.com/files/134602/Acunetix-WVS-10-Local-Privilege-Escalation.html
• https://www.acunetix.com/blog/releases/acunetix-10-build-includes-security-checks-in-cors-configurations/
• https://www.exploit-db.com/exploits/38847/

Get alerted when CVE-2015-4027 or the next vulnerability affects your stack