CVE-2021-30117

CVE-2021-30117 affects Kaseya VSA prior to 9.5.6. It is a semi-authenticated boolean-based blind SQL injection in the exportFldr.asp endpoint (fldrId parameter). Connected CVE data confirms the affected product and the vulnerable version range (

CVE-2021-30118

CVE-2021-30118 affects Kaseya VSA (RMM) prior to 9.5.7, via unauthenticated arbitrary file upload in the web UI path /SystemTab/uploader.aspx. The request can write files with arbitrary content to locations the web server can access (e.g., webroot) and, if code (ASPX) is uploaded, execute it in t...

CVE-2021-30119

CVE-2021-30119 is a Cross-Site Scripting vulnerability in Kaseya VSA (on-premises) that enables authenticated, reflective XSS via the HelpDeskTab/rcResults.asp parameter result and the done.asp FileName parameter. Affected product/version details are referenced across sources (Kaseya VSA

CVE-2021-30120

Kaseya VSA 2FA bypass (CVE-2021-30120) affects VSA up to version 9.5.6, where after a valid username/password login the server’s response exposes MFARequired/MFAEnroled booleans and an intercepting proxy can flip MFARequired to False, bypassing 2FA and allowing login without a second factor. This...

CVE-2021-30201

CVE-2021-30201 affects Kaseya VSA (on‑premises/server side) where the API /vsaWS/KaseyaWS.asmx processes XML with external entities. The vulnerability arises from insecure handling of XML external entities, allowing an attacker to cause the server to read local files (e.g., c:\kaseya\kserver\kser...

CVE-2021-30121

CVE-2021-30121 is described as a semi-authenticated local file inclusion vulnerability. The NVD description shows an attacker could fetch contents of arbitrary files via the webserver (example: Kaseya-related path) and notes that a valid sessionId is required, which can be obtained via CVE-2021-3...

CVE-2019-14510

CVE-2019-14510 affects Kaseya VSA RMM up to 9.5.0.22. The default LAN Cache configuration creates a local account FSAdminxxxxxxxxx on the LAN Cache host and all assigned clients, placing it in each client’s local Administrators group. If a client is a Domain Controller, the account is created as ...