seling 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk cross-site scripting、vendor risk csrf, and vendor risk memory corruption に関連することが多く、vendor surface production workloads and vendor surface software deployment の文脈で vendor impact memory corruption and アプリケーションクラッシュ などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2023-42250 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php. | [email protected] | 6.1 | 0.32% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42249 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php. | [email protected] | 6.1 | 0.32% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42248 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vam_Sql.php". | [email protected] | 6.5 | 0.19% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42247 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php. | [email protected] | 6.1 | 0.24% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42246 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php. | [email protected] | 6.1 | 0.24% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42245 | Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php. | [email protected] | 6.1 | 0.24% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42244 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_visits.php. | [email protected] | 8.8 | 0.17% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42243 | In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for arbitrary SQL queries. | [email protected] | 5.4 | 0.22% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42242 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/s_terminal.php. | [email protected] | 3.8 | 0.10% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42241 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_anagraphic.php. | [email protected] | 3.8 | 0.18% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42240 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /monitor/s_scheduledfile.php. | [email protected] | 3.8 | 0.18% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42239 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_ep.php. | [email protected] | 3.8 | 0.18% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42238 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_eps.php. | [email protected] | 3.8 | 0.18% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42237 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters of /vam/vam_i_command.php. | [email protected] | 3.8 | 0.18% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42236 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php. | [email protected] | 3.8 | 0.18% | 2025-01-13 | 2025-04-17 |
| CVE-2023-42235 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple parameters of /monitor/s_normalizedtrans.php. | [email protected] | 3.8 | 0.19% | 2025-01-13 | 2025-04-17 |
| CVE-2023-50811 | An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter, it has been possible to access to the application and take control of many other receptions in addition the assigned one. | [email protected] | 6.5 | 0.05% | 2024-03-19 | 2025-03-27 |
| CVE-2019-19994 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by injecting the vulnerable parameter in the PHP Web page /common/vam_monitor_sap.php. | [email protected] | 9.8 | 7.34% | 2020-02-26 | 2024-11-21 |
| CVE-2019-19993 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages to generate error messages that expose some full paths. | [email protected] | 5.3 | 0.31% | 2020-02-26 | 2024-11-21 |
| CVE-2019-19992 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem via the web interface. The PHP page /common/vam_editXml.php doesn't check the parameter that identifies the file name to be read. Thus, an attacker can manipulate the file name to access a potentially sensitive file within the filesystem. | [email protected] | 6.5 | 0.42% | 2020-02-26 | 2024-11-21 |