CVE-2021-21925

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘firmfilter’ parameter...

CVE-2021-21925

CVE-2021-21925 affects Advantech R-SeeNet (industrial monitoring software). The vulnerability is an SQL injection on the device_list page, exploitable by authenticated users (including via CSRF) through parameters such as firm_filter, desc_filter, and others that feed into SQL queries. The provid...

CVE-2021-21924

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘descfilter’ parameter...

CVE-2021-21924

CVE-2021-21924 maps to multiple SQL injection vulnerabilities in Advantech R-SeeNet (monitoring software). Public details describe exploitable flaws in the device_list queries where a session-based desc_filter and other filters (host, health, loc, prod, sn, mac, name, esn, imei, etc.) are concate...

CVE-2021-21923

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘companyfilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21923

Advantech R-SeeNet contains multiple SQL injection vulnerabilities in the user_list page (filters: username_filter, name_filter, surname_filter, company_filter) due to improper neutralization of inputs and dynamic SQL/concatenated queries. Exploitation can be triggered by authenticated requests o...

CVE-2021-21922

CVE-2021-21922 affects Advantech R-SeeNet (2.4.15 and prior) via SQL injection in the user_list page, caused by improper neutralization of inputs in several filters (username_filter, name_filter, surname_filter, company_filter). An authenticated user (or via CSRF) can inject SQL through these par...

CVE-2021-21922

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘usernamefilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21920

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘surnamefilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21921

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘namefilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21920

CVE-2021-21920 affects Advantech R-SeeNet (2.4.15 and earlier) via the SQL injection on the user_list page, caused by improper handling of the surname_filter parameter. The vulnerability builds a dynamic SQL query by concatenating user-controlled input into the query, and it can be triggered by a...

CVE-2021-21921

CVE-2021-21921 affects Advantech R-SeeNet (2.4.15 era) with SQL injection in the name_filter parameter of the user_list page. The root cause is improper neutralization/concatenation of SQL, enabling authenticated users (and CSRF) to inject SQL via the name_filter input. Talos reports multiple SQL...

CVE-2021-21919

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ord’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery attack...

CVE-2021-21919

Advantech R-SeeNet contains multiple SQL injection flaws in the web app (notably on the company_list page), caused by improper neutralization of SQL input and dynamic query construction. Exploitation requires an authenticated user with elevated privileges (super-administrator), per TALOS-2021-136...

CVE-2021-21918

CVE-2021-21918 affects Advantech R-SeeNet 2.4.15 where the name_filter parameter on the company_list page can be exploited to trigger SQL injection via a crafted authenticated HTTP request. The root cause is improper input handling in building SQL for the stored procedure call sp_GetCompanies, wi...

CVE-2021-21918

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘namefilter’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery...

CVE-2021-21916

An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request at 'descriptionfilter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any...

CVE-2021-21917

CVE-2021-21917 highlights multiple SQL injection vulnerabilities in Advantech R-SeeNet, specifically in the group_list page of version 2.4.15 (and prior). The root cause is improper neutralization/handling of user-supplied input in several parameters used to build SQL queries (ord, company_filter...

CVE-2021-21917

An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request at '‘ord’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticated user or...

CVE-2021-21916

Advantech R-SeeNet 2.4.15 (and prior) contains SQL injection vulnerabilities on the group_list page, including the description_filter parameter. The TALOS advisory documents multiple SQLi flaws in group_list with authenticated user or CSRF-enabled attack paths, and provides concrete proof-of-conc...