CVE-2021-21932

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘namefilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21931

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at‘ statfilter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21931

CVE-2021-21931 affects Advantech R-SeeNet web interface. Multiple SQL injection paths exist in device_list.php (notably via stat_filter and related filters like host/prod/desc/etc.), allowing authenticated users (or CSRF-tied actions) to inject SQL through crafted HTTP requests. TALOS and related...

CVE-2021-21930

CVE-2021-21930 affects Advantech R-SeeNet 2.4.15 (and related entries) with multiple SQL injection vulnerabilities in the device_list page, including filters such as sn_filter, prod_filter, mac_filter, host_filter, name_filter, esn_filter, imei_filter and others. The root cause is improper neutra...

CVE-2021-21930

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘snfilter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21929

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘prodfilter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21929

CVE-2021-21929 affects Advantech R-SeeNet. Multiple SQL injection vulnerabilities exist in the device_list page via numerous filters (e.g., prod_filter), due to how user/session inputs are incorporated into dynamic SQL. Exploitation can be performed by authenticated users (and may be CSRF-enabled...

CVE-2021-21928

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘macfilter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21928

CVE-2021-21928 affects Advantech R-SeeNet (2.4.x and prior) with multiple SQL injection flaws in the web UI (e.g., device_list.php: mac_filter, desc_filter, loc_filter, prod_filter, sn_filter, etc.). An authenticated user or CSRF can trigger crafted HTTP requests to inject SQL via interpolated qu...

CVE-2021-21926

CVE-2021-21926 affects Advantech R-SeeNet. Talos documents multiple SQL injection flaws in the device_list page (e.g., health_filter, desc_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, esn_filter, imei_filter, host_alt_filter2, host_alt_filter, etc.) that can be triggered b...

CVE-2021-21927

CVE-2021-21927 (plus related CVEs 21928–21937) affects Advantech R-SeeNet. Talos reports multiple SQL injection vulnerabilities in the device_list page (parameters including host_filter, health_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, esn_filter, imei_filter, imei, hos...

CVE-2021-21926

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘healthfilter’ parameter...

CVE-2021-21927

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘locfilter’ parameter...

CVE-2021-21925

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘firmfilter’ parameter...

CVE-2021-21925

CVE-2021-21925 affects Advantech R-SeeNet (industrial monitoring software). The vulnerability is an SQL injection on the device_list page, exploitable by authenticated users (including via CSRF) through parameters such as firm_filter, desc_filter, and others that feed into SQL queries. The provid...

CVE-2021-21924

CVE-2021-21924 maps to multiple SQL injection vulnerabilities in Advantech R-SeeNet (monitoring software). Public details describe exploitable flaws in the device_list queries where a session-based desc_filter and other filters (host, health, loc, prod, sn, mac, name, esn, imei, etc.) are concate...

CVE-2021-21924

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘descfilter’ parameter...

CVE-2021-21923

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘companyfilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21923

Advantech R-SeeNet contains multiple SQL injection vulnerabilities in the user_list page (filters: username_filter, name_filter, surname_filter, company_filter) due to improper neutralization of inputs and dynamic SQL/concatenated queries. Exploitation can be triggered by authenticated requests o...

CVE-2021-21922

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘usernamefilter’ parameter with the administrative account or through cross-site request forgery...