CVE-2023-42245

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross Site Scripting (XSS) via the monitor/s_scheduledfile.php endpoint. This vulnerability allows for potential malicious script injection due to the improper neutralization of input during web page generation. To resolve t...

CVE-2023-42243

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to a SQL injection vulnerability. The root cause is a lack of validation for externally entered SQL statements within the administrative page /common/vam_Sql.php . An authenticated user can exploit this flaw to perform arbitrar...

CVE-2023-42244

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The flaw stems from a lack of validation of externally entered SQL statements within the application. An authenticated attacker can exploit this by targeting multiple POST parameters of the /va...

CVE-2023-42248

Selesta Visual Access Manager (VAM) versions prior to 4.42.2 are vulnerable to a security issue where an authenticated attacker can write arbitrary files . This is achieved by manipulating POST parameters of the page common/vam_Sql.php. As a remediation, users should update to version 4.42.2 or l...

CVE-2023-42237

Selesta Visual Access Manager (VAM) versions prior to 4.42.2 are vulnerable to an SQL Injection flaw. The root cause is the application's failure to properly validate externally entered SQL statements in multiple GET parameters of the /vam/vam_i_command.php endpoint. An authenticated attacker can...

CVE-2023-42246

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation in the /vam/vam_ep.php API endpoint. This flaw allows an attacker to inject malicious scripts into...

CVE-2023-42238

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) in versions prior to 4.42.2 . An authenticated attacker can exploit this issue by targeting multiple POST parameters within the /vam/vam_eps.php API endpoint. This vulnerability could allow an attacker to execute arbitra...

CVE-2023-42239

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is a lack of validation for externally entered SQL statements, allowing an authenticated attacker to perform SQL injection via multiple POST parameters of the /vam/vam_ep.php API...

CVE-2023-42250

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to Cross-Site Scripting (XSS) . The root cause is the application's lack of effective filtering and escaping of user-supplied data, specifically within the /common/autocomplete.php file. An attacker can exploit this by sending ...

CVE-2023-42247

Selesta Visual Access Manager versions prior to 4.42.2 are vulnerable to a Cross Site Scripting (XSS) vulnerability via the monitor/s_monitor_map.php endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data, which could allow for potential malicious script ex...

CVE-2023-42240

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . An authenticated attacker can exploit this flaw by targeting multiple POST parameters of the /monitor/s_scheduledfile.php endpoint. While the technical impact is noted as partial , the vulnerab...

CVE-2023-42242

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . An authenticated attacker can exploit a GET parameter in the /monitor/s_terminal.php endpoint to perform SQL injection. To remediate this issue, users should update to version 4.42.2 or later. ...

CVE-2023-42249

Selesta Visual Access Manager versions prior to 4.42.2 are susceptible to a Cross Site Scripting (XSS) vulnerability. The flaw exists within the vam/vam_visits.php file, where improper neutralization of input during web page generation allows an attacker to execute malicious scripts. Practical co...

CVE-2023-42235

Selesta Visual Access Manager (VAM) versions prior to 4.42.2 are vulnerable to an SQL Injection flaw. An authenticated attacker can exploit multiple parameters within the /monitor/s_normalizedtrans.php API endpoint. To remediate this issue, users should update to version 4.42.2 or later. As a tem...

CVE-2023-42236

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . The root cause is a lack of validation of the GET parameter in the /common/ajaxfunction.php endpoint against externally entered SQL statements. An authenticated attacker can exploit this flaw t...

CVE-2023-42241

An SQL Injection vulnerability exists in Selesta Visual Access Manager (VAM) versions prior to 4.42.2 . An authenticated attacker can exploit this flaw by targeting multiple POST parameters within the /vam/vam_anagraphic.php endpoint. Successful exploitation may allow for data manipulation . To r...