Eginnovations Eg Manager — known CVE vulnerabilities

Every CVE whose affected-product data names Eginnovations Eg Manager, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2020-8591 — CVSS 9.8 (critical): eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request.
• CVE-2020-8592 — CVSS 9.8 (critical): eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature).
• CVE-2022-29594 — CVSS 7.8 (high): eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM.