Filtered by vendor Setelsa-security Subscriptions
Filtered by product Conacwin Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-4037 1 Setelsa-security 1 Conacwin 2024-11-21 9.9 Critical
Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored in the database by sending a specially crafted SQL query to the xml parameter.
CVE-2023-3512 1 Setelsa-security 1 Conacwin 2024-11-21 7.5 High
Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.
CVE-2020-25068 1 Setelsa-security 1 Conacwin 2024-11-21 7.5 High
Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. This vulnerability allows a remote unauthenticated attacker to read internal files on the server via an http:IP:PORT/../../path/file_to_disclose Directory Traversal URI. NOTE: The manufacturer indicated that the affected version does not exist. Furthermore, they indicated that they detected this problem in an internal audit more than 3 years ago and fixed it in 2017.