195 matches found
CVE-2023-42242
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/sterminal.php...
CVE-2023-42243
In Selesta Visual Access Manager 4.42.2, an authenticated user can access the administrative page /common/vamSql.php, which allows for arbitrary SQL queries...
CVE-2023-42244
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamvisits.php...
CVE-2023-42237
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters of /vam/vamicommand.php...
CVE-2023-42235
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple parameters of /monitor/snormalizedtrans.php...
CVE-2023-42236
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php...
CVE-2023-42235
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple parameters of /monitor/snormalizedtrans.php...
CVE-2023-42236: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php...
CVE-2023-42245: Improper Neutralization of Input During Web Page Generation
Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via monitor/sscheduledfile.php...
CVE-2023-42244: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamvisits.php...
CVE-2023-42242: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/sterminal.php...
CVE-2023-42241: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamanagraphic.php...
CVE-2023-42250: Improper Neutralization of Input During Web Page Generation
Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via /common/autocomplete.php...
CVE-2023-42248: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vamSql.php"...
CVE-2023-42246: Improper Neutralization of Input During Web Page Generation
Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via /vam/vamep.php...
CVE-2023-42235: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple parameters of /monitor/snormalizedtrans.php...
CVE-2023-42249
Selesta Visual Access Manager 4.42.2 is vulnerable to Cross Site Scripting XSS via vam/vamvisits.php...
CVE-2023-42250
Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross-Site Scripting (XSS) via the /common/autocomplete.php file. The root cause is a lack of effective filtering and escaping of user-supplied data, which could allow an attacker to inject and execute arbitrary JavaScript c...
CVE-2023-42249
Selesta Visual Access Manager versions prior to 4.42.2 are susceptible to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the vam/vam_visits.php file, where improper neutralization of input during web page generation allows an attacker to execute malicious scripts. Practical co...