CVE-2021-38390

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...

CVE-2021-32983

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerCFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter keyword before using it as part of an SQL query. A...

CVE-2021-38390

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...

CVE-2021-38391

A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...

CVE-2021-38390

CVE-2021-38390 affects Delta Electronics DIAEnergie (endpoint /DataHandler/HandlerEnergyType.ashx). The flaw is an improper validation of the egyid parameter, enabling Blind SQL Injection that can lead to arbitrary code execution in the MSSQLSERVER context. Public advisories note the vulnerabilit...

CVE-2021-38390

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...

CVE-2021-32983

Delta Electronics DIAEnergie vulnerability CVE-2021-32983 is a Blind SQL Injection in the /DataHandler/Handler_CFG.ashx endpoint (versions prior to 1.9). The flaw arises from improper validation of the keyword parameter before building an SQL query, allowing remote, unauthenticated attackers to e...

CVE-2021-38393

Delta Electronics DIAEnergie (all versions before 1.9) contains a Blind SQL injection in /DataHandler/HandlerAlarmGroup.ashx via the agid parameter, enabling remote, unauthenticated code execution in NT SERVICES\MSSQLSERVER. This is tied to CVE-2021-38393. Impact is high (CVE has CVSS v3.1 base s...

CVE-2021-38391

A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...

CVE-2021-37749

MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...

CVE-2021-37749

MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...

Sql injection

MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...

CVE-2021-37749

The CVE-2021-37749 entry concerns Hexagon GeoMedia WebMap 2020 prior to Update 2 (16.6.2.66). A vulnerability in MapService.svc allows blind SQL injection via the Id (within sourceItems) parameter to the GetMap method. CVSSv3.1 base score 9.8 (CRITICAL) with network attack vector, no user interac...

PT-2021-22107

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists in the "/DataHandler/HandlerAlarmGroup.ashx" endpoint. The application does not properly validate the user-controlled value supplied through t...

PT-2021-22105

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists due to improper validation of the type parameter in the "/DataHandler/AM/AM Handler.ashx" endpoint. This allows a remote, unauthenticated...

PT-2021-21860

Name of the Vulnerable Software and Affected Versions: Hexagon GeoMedia WebMap 2020 versions prior to 16.6.2.66 Description: The issue allows blind SQL Injection via the Id parameter within sourceItems to the GetMap method. This can be exploited through the MapService.svc endpoint. Recommendation...

PT-2021-22104

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists due to improper validation of the user-controlled value supplied through the egyid parameter in the "/DataHandler/HandlerEnergyType.ashx"...

CVE-2021-38390: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...

CVE-2021-38393: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query....

CVE-2021-38391: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...