CVE-2023-42250

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross-Site Scripting (XSS) via the /common/autocomplete.php file. The root cause is a lack of effective filtering and escaping of user-supplied data, which could allow an attacker to inject and execute arbitrary JavaScript c...

CVE-2023-42249

Selesta Visual Access Manager versions prior to 4.42.2 are susceptible to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the vam/vam_visits.php file, where improper neutralization of input during web page generation allows an attacker to execute malicious scripts. Practical co...

CVE-2023-42242

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/sterminal.php...

CVE-2023-42244

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamvisits.php...

CVE-2023-42243

In Selesta Visual Access Manager 4.42.2, an authenticated user can access the administrative page /common/vamSql.php, which allows for arbitrary SQL queries...

CVE-2023-42245

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross Site Scripting (XSS) via the monitor/s_scheduledfile.php endpoint. This vulnerability allows for potential malicious script injection due to the improper neutralization of input during web page generation. To resolve t...

CVE-2023-42246

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation in the /vam/vam_ep.php API endpoint. This flaw allows an attacker to inject malicious scripts into...

CVE-2023-42240

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /monitor/sscheduledfile.php...

CVE-2023-42237

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters of /vam/vamicommand.php...

CVE-2023-42236

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php...

CVE-2023-42240

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) prior to version 4.42.2 . An authenticated attacker can exploit this issue by targeting multiple POST parameters within the /monitor/s_scheduledfile.php endpoint. This vulnerability is associated with CWE-89 (Improper Ne...

CVE-2023-42245

Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via monitor/sscheduledfile.php...

CVE-2023-42246

Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via /vam/vamep.php...

CVE-2023-42247

Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via monitor/smonitormap.php...

CVE-2023-42239

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamep.php...

CVE-2023-42237

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters of /vam/vamicommand.php...

CVE-2023-42238

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vameps.php...

CVE-2023-42241

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamanagraphic.php...

PT-2025-1462 · Selesta · Selesta Visual Access Manager

Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager VAM versions prior to 4.42.2 Description: An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in a GET parameter of "/common/ajaxfunction.php"...

PT-2025-1465 · Selesta · Selesta Visual Access Manager

Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager VAM versions prior to 4.42.2 Description: An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in multiple POST parameters of the "/vam/vam ep.php...