CVE-2023-42245

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross Site Scripting (XSS) via the monitor/s_scheduledfile.php endpoint. This vulnerability allows for potential malicious script injection due to the improper neutralization of input during web page generation. To resolve t...

CVE-2023-42243

In Selesta Visual Access Manager versions prior to 4.42.2 , an authenticated user can access the administrative page /common/vam_Sql.php . This vulnerability is caused by a lack of validation of externally entered SQL statements, which allows an attacker to perform arbitrary SQL queries . Practic...

CVE-2019-19994

The CVE-2019-19994 entry concerns Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. It describes a vulnerability in the PHP page /common/vam_monitor_sap.php that allows blind command injection. The issue can be exploited by an attacker without authentication to execute arbitrary o...

CVE-2019-19992

The CVE refers to Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. The vulnerability arises from /common/vam_editXml.php not validating the file-name parameter, allowing an authenticated user to read arbitrary XML files from the server filesystem via the web interface. This is a ...

CVE-2023-50811

SELESTA Visual Access Manager 4.38.6 is affected by CVE-2023-50811. The vulnerability allows an attacker to modify the POST parameter named “computer” that encodes the ID of a specific reception via HTTP POST interception. By iterating this parameter, an attacker can gain access to the applicatio...

CVE-2023-42248

An authenticated attacker can write arbitrary files in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is the ability to manipulate POST parameters of the "common/vam_Sql.php" page. To remediate this vulnerability, users should update to version 4.42.2 or later. As a...

CVE-2019-19986

The CVE-2019-19986 entry affects Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. An unauthenticated attacker can inject the persoid parameter in /tools/VamPersonPhoto.php to execute arbitrary SQL SELECT statements. The vulnerability is described as error-based SQL injection. Pub...

CVE-2019-19991

CVE-2019-19991 concerns Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29, where multiple reflected XSS flaws are exploitable by remote authenticated users. The vulnerabilities affect specific web pages: /vam/vam_anagraphic.php, /vam/vam_vamuser.php, /common/vamp_main.php, and /wiz...

CVE-2023-42244

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The flaw stems from a lack of validation of externally entered SQL statements within the application. An authenticated attacker can exploit this by targeting multiple POST parameters of the /va...

CVE-2023-42237

Selesta Visual Access Manager (VAM) versions prior to 4.42.2 are vulnerable to SQL Injection due to a lack of validation for externally entered SQL statements. An authenticated attacker can exploit this by targeting multiple GET parameters in the /vam/vam_i_command.php endpoint. This vulnerabilit...

CVE-2023-42246

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation in the /vam/vam_ep.php API endpoint. This flaw allows an attacker to inject malicious scripts into...

CVE-2023-42238

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) prior to version 4.42.2 . An authenticated attacker can exploit this issue by targeting multiple POST parameters of the /vam/vam_eps.php API endpoint. This vulnerability allows for the execution of unauthorized SQL comma...

CVE-2023-42239

An authenticated attacker can perform SQL Injection in Selesta Visual Access Manager (VAM) prior to version 4.42.2 . The vulnerability exists because the application fails to properly validate externally entered SQL statements in multiple POST parameters of the /vam/vam_ep.php API endpoint. Succe...

CVE-2023-42240

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) prior to version 4.42.2 . An authenticated attacker can exploit this issue by targeting multiple POST parameters within the /monitor/s_scheduledfile.php endpoint. This vulnerability is associated with CWE-89 (Improper Ne...

CVE-2023-42250

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross-Site Scripting (XSS) via the /common/autocomplete.php file. The root cause is a lack of effective filtering and escaping of user-supplied data, which could allow an attacker to inject and execute arbitrary JavaScript c...

CVE-2019-19988

The CVE-2019-19988 issue affects Selesta Visual Access Manager (VAM) versions 4.15.0–4.29. An authenticated user can create and write arbitrary files on the filesystem via the web interface, by manipulating the file name, destination path, or extension in /common/vam_editXml.php. The vulnerable p...

CVE-2019-19993

Selesta Visual Access Manager (VAM) 4.15.0–4.29.x contains a full path disclosure vulnerability. An unauthenticated attacker can send arbitrary content to vulnerable pages, causing error messages that reveal full filesystem paths. Impact described as confidentiality exposure (partial). Root cause...

CVE-2019-19987

CVE-2019-19987 affects Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29.0. The vulnerability is a Cross-Site Request Forgery (CSRF) in the web application’s handling of HTML forms, allowing an attacker to abuse functions such as change password, add user, and add privilege. Root c...

CVE-2023-42247

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to a Cross Site Scripting (XSS) vulnerability via the monitor/s_monitor_map.php endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data, which could allow for potential malicious script ex...

CVE-2019-19990

CVE-2019-19990 concerns a stored XSS vulnerability in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. The issue enables remote authenticated users to inject arbitrary web script/HTML via the pages /monitor/s_headmodel.php and /vam/vam_user.php , due to lack of proper validation ...

CVE-2019-19989

Selesta Visual Access Manager (VAM) versions 4.15.0–4.29 contain an unauthorized access issue where several PHP pages and other file types are reachable without checking user identity or authorization. Root cause: lack of access checks on these pages. Impact: potential exposure of PHP pages or fi...

CVE-2023-42242

An authenticated attacker can perform SQL Injection in the GET parameter of the /monitor/s_terminal.php endpoint in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is the improper neutralization of special elements used in an SQL command (CWE-89 ). To remediate this,...

CVE-2023-42249

Selesta Visual Access Manager versions prior to 4.42.2 are susceptible to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the vam/vam_visits.php file, where improper neutralization of input during web page generation allows an attacker to execute malicious scripts. Practical co...

CVE-2023-42241

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . An authenticated attacker can exploit multiple POST parameters in the /vam/vam_anagraphic.php endpoint (also referred to as /var/vam_anagraph.php in some records) to perform unauthorized data m...

CVE-2023-42235

The Selesta Visual Access Manager (VAM) is vulnerable to SQL Injection in versions prior to 4.42.2 . An authenticated attacker can exploit this flaw by targeting multiple parameters within the /monitor/s_normalizedtrans.php API endpoint. The impact allows for unauthorized database interaction via...

CVE-2023-42236

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is a lack of validation of the GET parameter in the /common/ajaxfunction.php endpoint against externally entered SQL statements. An authenticated attacker can exploit this flaw t...