Plixer vulnerabilities (CVEs)

3 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

• CVE-2012-3951 ↗EPSS 52%LEV ≥>99%Probably exploited

  The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (…

• CVE-2012-2626 ↗EPSS 44%LEV ≥>99%Probably exploited

  cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows rem…

• CVE-2012-2962 ↗EPSS 67%LEV ≥>99%Probably exploited

  SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to exe…

• CVE-2012-1258 is now estimated at a 94% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
• CVE-2012-2627 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2012-3951 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2012-2962 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2012-1258 is now estimated at a 94% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

• CVE-2023-41263 ↗LOW 3.72023

  An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With knowledge of valid IP addresses and source types, an unauthent…

• CVE-2023-41262 ↗CRITICAL 9.82023

  An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allo…

• ↗

• CVEs come from the US National Vulnerability Database (NVD) and are matched to Plixer by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-12.
• Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-20.
• Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.