Seling
Seling Visual Access Manager: vulnerabilities and CVEs
Seling Visual Access Manager has 26 published vulnerabilities, 0 of them in the last 12 months. 1 are rated critical and 0 are listed by CISA as actively exploited.
CVEs26
Last 12 months0
Critical1
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2023-42250 | Medium (6.1) | 0.23% | — | Jan 13, 2025 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php. |
| CVE-2023-42249 | Medium (6.1) | 0.23% | — | Jan 13, 2025 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php. |
| CVE-2023-42248 | Medium (6.5) | 0.36% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vam_Sql.php". |
| CVE-2023-42247 | Medium (6.1) | 0.23% | — | Jan 13, 2025 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php. |
| CVE-2023-42246 | Medium (6.1) | 0.23% | — | Jan 13, 2025 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php. |
| CVE-2023-42245 | Medium (6.1) | 0.23% | — | Jan 13, 2025 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php. |
| CVE-2023-42244 | High (8.8) | 0.38% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_visits.php. |
| CVE-2023-42243 | Medium (5.4) | 0.24% | — | Jan 13, 2025 | In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for arbitrary SQL queries. |
| CVE-2023-42242 | Low (3.8) | 0.32% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/s_terminal.php. |
| CVE-2023-42241 | Low (3.8) | 0.24% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_anagraphic.php. |
| CVE-2023-42240 | Low (3.8) | 0.24% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /monitor/s_scheduledfile.php. |
| CVE-2023-42239 | Low (3.8) | 0.32% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_ep.php. |
| CVE-2023-42238 | Low (3.8) | 0.32% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_eps.php. |
| CVE-2023-42237 | Low (3.8) | 0.24% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters of /vam/vam_i_command.php. |
| CVE-2023-42236 | Low (3.8) | 0.32% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php. |
| CVE-2023-42235 | Low (3.8) | 0.32% | — | Jan 13, 2025 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple parameters of /monitor/s_normalizedtrans.php. |
| CVE-2023-50811 | Medium (6.5) | 0.45% | — | Mar 19, 2024 | An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter,… |
| CVE-2019-19994 | Critical (9.8) | 4.8% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by… |
| CVE-2019-19993 | Medium (5.3) | 1.2% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to… |
| CVE-2019-19992 | Medium (6.5) | 1.1% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem via the web interface. The PHP page /common/vam_editXml.php… |
| CVE-2019-19991 | Medium (5.4) | 0.86% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Reflected Cross-site scripting (XSS) vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML… |
| CVE-2019-19990 | Medium (5.4) | 0.86% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Stored Cross-site scripting (XSS) vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via… |
| CVE-2019-19989 | High (7.5) | 1.3% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several PHP pages, and other type of files, are reachable by any user without checking for user identity and authorization. |
| CVE-2019-19988 | High (8.8) | 1.5% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to create and write XML files on the filesystem via /common/vam_editXml.php in the web interface.… |
| CVE-2019-19987 | Medium (6.5) | 0.55% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker can exploit the vulnerability to abuse functionalities such… |
| CVE-2019-19986 | High (7.5) | 1.3% | — | Feb 26, 2020 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. An attacker without authentication is able to execute arbitrary SQL SELECT statements by injecting the HTTP (POST or GET) parameter… |