CVE-2023-42241

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . An authenticated attacker can exploit multiple POST parameters in the /vam/vam_anagraphic.php endpoint (also referred to as /var/vam_anagraph.php in some records) to perform unauthorized data m...

PT-2025-1466

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions prior to 4.42.2 Description An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in multiple POST parameters of the "/monitor/s...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements, which can be exploited by an attacker to perform SQL injection...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. A SQL injection vulnerability exists in Selesta Visual Access Manager, which can be exploited by an attacker to perform SQL injection in the POST parameter of /vam/vameps.php...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in /common/vamSql.php. An attacker can exploit this vulnerability to perform...

CVE-2023-42240: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /monitor/sscheduledfile.php...

CVE-2023-42242

An authenticated attacker can perform SQL Injection in the GET parameter of the /monitor/s_terminal.php endpoint in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is the improper neutralization of special elements used in an SQL command (CWE-89 ). To remediate this,...

PT-2025-1469

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager versions prior to 4.42.2 Description The issue allows an authenticated user to access the administrative page "/common/vam Sql.php", which permits arbitrary SQL queries. This can be exploited by sending queries to...

CVE-2023-42238: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vameps.php...

CVE-2023-42249: Improper Neutralization of Input During Web Page Generation

Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via vam/vamvisits.php...

CVE-2023-42237: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters of /vam/vamicommand.php...

CVE-2023-42243: Improper Neutralization of Special Elements used in an SQL Command

In Selesta Visual Access Manager 4.42.2, an authenticated user can access the administrative page /common/vamSql.php, which allows for arbitrary SQL queries...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. A cross-site scripting vulnerability exists in the Selesta Visual Access Manager sscheduledfile.php file, no details of the vulnerability are available at this time...

CVE-2023-42248

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vamSql.php"...

CVE-2023-42247: Improper Neutralization of Input During Web Page Generation

Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via monitor/smonitormap.php...

CVE-2023-42250

Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via /common/autocomplete.php...

CVE-2023-42242

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/sterminal.php...

CVE-2023-42248

An authenticated attacker can write arbitrary files in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is the ability to manipulate POST parameters of the "common/vam_Sql.php" page. To remediate this vulnerability, users should update to version 4.42.2 or later. As a...

PT-2025-1467 · Selesta · Selesta Visual Access Manager

Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager VAM versions prior to 4.42.2 Description: An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in multiple POST parameters of "/vam/vam...

PT-2025-1476 · Unknown · Selesta Visual Access Manager

The software that is vulnerable is Selesta Visual Access Manager, specifically versions less than 4.42.2. The vulnerability is a Cross Site Scripting XSS vulnerability that can be exploited via the /common/autocomplete.php file. This vulnerability has been assigned the CVE identifier...