Vendor
GestSup
9 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
High 8.1
GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, w…
-
High 7.7
GestSup < 3.2.60 SQL Injection in Ticket Creation
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attack…
-
High 7.5
GestSup < 3.2.60 Multiple SQL Injections in Asset List
GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowing a…
-
High 7.7
GestSup < 3.2.60 SQL Injection in Search Bar
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database …
-
High 8.9
GestSup <= 3.2.60 CSRF Allows Privileged Actions
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform ac…