CVE-2023-42243

In Selesta Visual Access Manager versions prior to 4.42.2 , an authenticated user can access the administrative page /common/vam_Sql.php . This vulnerability is caused by a lack of validation of externally entered SQL statements, which allows an attacker to perform arbitrary SQL queries . Practic...

CVE-2023-42245

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross Site Scripting (XSS) via the monitor/s_scheduledfile.php endpoint. This vulnerability allows for potential malicious script injection due to the improper neutralization of input during web page generation. To resolve t...

CVE-2023-42248

An authenticated attacker can write arbitrary files in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is the ability to manipulate POST parameters of the "common/vam_Sql.php" page. To remediate this vulnerability, users should update to version 4.42.2 or later. As a...

CVE-2023-42237

Selesta Visual Access Manager (VAM) versions prior to 4.42.2 are vulnerable to SQL Injection due to a lack of validation for externally entered SQL statements. An authenticated attacker can exploit this by targeting multiple GET parameters in the /vam/vam_i_command.php endpoint. This vulnerabilit...

CVE-2023-42244

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The flaw stems from a lack of validation of externally entered SQL statements within the application. An authenticated attacker can exploit this by targeting multiple POST parameters of the /va...

CVE-2023-42239

An authenticated attacker can perform SQL Injection in Selesta Visual Access Manager (VAM) prior to version 4.42.2 . The vulnerability exists because the application fails to properly validate externally entered SQL statements in multiple POST parameters of the /vam/vam_ep.php API endpoint. Succe...

CVE-2023-42238

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) prior to version 4.42.2 . An authenticated attacker can exploit this issue by targeting multiple POST parameters of the /vam/vam_eps.php API endpoint. This vulnerability allows for the execution of unauthorized SQL comma...

CVE-2023-42246

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation in the /vam/vam_ep.php API endpoint. This flaw allows an attacker to inject malicious scripts into...

CVE-2023-42240

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) prior to version 4.42.2 . An authenticated attacker can exploit this issue by targeting multiple POST parameters within the /monitor/s_scheduledfile.php endpoint. This vulnerability is associated with CWE-89 (Improper Ne...

CVE-2023-42247

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to a Cross Site Scripting (XSS) vulnerability via the monitor/s_monitor_map.php endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data, which could allow for potential malicious script ex...

CVE-2023-42250

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross-Site Scripting (XSS) via the /common/autocomplete.php file. The root cause is a lack of effective filtering and escaping of user-supplied data, which could allow an attacker to inject and execute arbitrary JavaScript c...

CVE-2023-42242

An authenticated attacker can perform SQL Injection in the GET parameter of the /monitor/s_terminal.php endpoint in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is the improper neutralization of special elements used in an SQL command (CWE-89 ). To remediate this,...

CVE-2023-42249

Selesta Visual Access Manager versions prior to 4.42.2 are susceptible to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the vam/vam_visits.php file, where improper neutralization of input during web page generation allows an attacker to execute malicious scripts. Practical co...

CVE-2023-42236

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is a lack of validation of the GET parameter in the /common/ajaxfunction.php endpoint against externally entered SQL statements. An authenticated attacker can exploit this flaw t...

CVE-2023-42235

The Selesta Visual Access Manager (VAM) is vulnerable to SQL Injection in versions prior to 4.42.2 . An authenticated attacker can exploit this flaw by targeting multiple parameters within the /monitor/s_normalizedtrans.php API endpoint. The impact allows for unauthorized database interaction via...

CVE-2023-42241

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . An authenticated attacker can exploit multiple POST parameters in the /vam/vam_anagraphic.php endpoint (also referred to as /var/vam_anagraph.php in some records) to perform unauthorized data m...