Gss
Monthly
Authenticated SQL injection in Galaxy Software Services' Vitals ESP (versions 0 through 6.3) lets a logged-in user pass crafted SQL through a vulnerable application input and read arbitrary data from the underlying database. Exploitation requires a valid Vitals ESP account - the CVSS vector records PR:L (authenticated), so an unauthenticated internet attacker cannot trigger it directly - but no further user interaction or non-default configuration is needed once access is obtained. Impact is confined to confidentiality (VC:H) with no integrity or availability effect, and there is no public exploit code or CISA KEV entry at time of analysis; EPSS is 0.06% (17th percentile), consistent with a moderate-priority, internally-exposed issue rather than an urgent one.
A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated SQL injection in Galaxy Software Services' Vitals ESP (versions 0 through 6.3) lets a logged-in user pass crafted SQL through a vulnerable application input and read arbitrary data from the underlying database. Exploitation requires a valid Vitals ESP account - the CVSS vector records PR:L (authenticated), so an unauthenticated internet attacker cannot trigger it directly - but no further user interaction or non-default configuration is needed once access is obtained. Impact is confined to confidentiality (VC:H) with no integrity or availability effect, and there is no public exploit code or CISA KEV entry at time of analysis; EPSS is 0.06% (17th percentile), consistent with a moderate-priority, internally-exposed issue rather than an urgent one.
A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.