CVE-2025-2353: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...

CVE-2025-2354: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in VAM Virtual Airlines Manager 2.6.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vam/index.php. The manipulation of the argument registryid/planeicao/hubid leads to cross site scripting. The attack can be...