Hercules Core

Hercules Core has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (33%). Other recurring categories include Missing Authorization, Server-Side Request Forgery (SSRF).

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, most of them (2) reported by Dave Jong.

01234567891026.03.2024Today26.03.20248.8Hercules Core <= 6.4 - Authenticated (Subscriber+) PHP Object Injection CVSS 8.8 · 26.03.202421.06.20245.4Hercules Core <= 6.5 - Missing Authorization to Settings Update CVSS 5.4 · 21.06.202421.10.20256.4Hercules Core <= 7.4 - Authenticated (Subscriber+) Server-Side Request Forgery CVSS 6.4 · 21.10.2025

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage67%
Open

1

Fixed

2

Get automatic notifications for all Hercules Core vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-63010

Hercules Core <= 7.4 - Authenticated (Subscriber+) Server-Side Request Forgery

Read the full analysis

Vulnerability Records

3 records
Showing 1–3 of 3 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C