Vitalsesp
Monthly
Authenticated SQL injection in Vitals ESP versions 0 through 6.1 (Galaxy Software Services) allows a remote attacker holding a valid low-privilege session to inject arbitrary SQL commands and read the contents of the underlying database. The flaw is rated CVSS 7.1 by the vendor-side vector (CVSS:4.0) and maps to an assessed high-confidentiality, no-integrity, no-availability impact (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it cannot by itself alter data or take the service down - impact is bounded to information disclosure. No public exploit code has been identified at time of analysis, it is not listed in CISA KEV, and EPSS is very low at 0.06% (17th percentile), which combined with the authentication prerequisite and the product's predominantly Taiwanese enterprise deployment base keeps this a moderate-priority issue rather than an urgent one.
Authenticated SQL injection in Galaxy Software Services' Vitals ESP (versions 0 through 6.3) lets a logged-in user pass crafted SQL through a vulnerable application input and read arbitrary data from the underlying database. Exploitation requires a valid Vitals ESP account - the CVSS vector records PR:L (authenticated), so an unauthenticated internet attacker cannot trigger it directly - but no further user interaction or non-default configuration is needed once access is obtained. Impact is confined to confidentiality (VC:H) with no integrity or availability effect, and there is no public exploit code or CISA KEV entry at time of analysis; EPSS is 0.06% (17th percentile), consistent with a moderate-priority, internally-exposed issue rather than an urgent one.
Arbitrary file read in Vitals ESP (Galaxy Software Services) versions 0 through 6.3 lets a remote attacker who already holds a high-privilege account abuse an absolute path traversal in the product's file-retrieval/download functionality to read arbitrary files from the host filesystem, exposing configuration data, credentials and other sensitive content. The flaw is privilege-gated rather than broadly reachable: the vendor-rated CVSS 4.0 score is 6.9 and our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so impact is confined to confidentiality with no integrity or availability effect. Exploitation requires an authenticated high-privilege session, no user interaction and low attack complexity; EPSS is 0.07% (22nd percentile), there is no CISA KEV entry, and no public exploit code identified at time of analysis.
Authenticated SQL injection in Vitals ESP versions 0 through 6.1 (Galaxy Software Services) allows a remote attacker holding a valid low-privilege session to inject arbitrary SQL commands and read the contents of the underlying database. The flaw is rated CVSS 7.1 by the vendor-side vector (CVSS:4.0) and maps to an assessed high-confidentiality, no-integrity, no-availability impact (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it cannot by itself alter data or take the service down - impact is bounded to information disclosure. No public exploit code has been identified at time of analysis, it is not listed in CISA KEV, and EPSS is very low at 0.06% (17th percentile), which combined with the authentication prerequisite and the product's predominantly Taiwanese enterprise deployment base keeps this a moderate-priority issue rather than an urgent one.
Authenticated SQL injection in Galaxy Software Services' Vitals ESP (versions 0 through 6.3) lets a logged-in user pass crafted SQL through a vulnerable application input and read arbitrary data from the underlying database. Exploitation requires a valid Vitals ESP account - the CVSS vector records PR:L (authenticated), so an unauthenticated internet attacker cannot trigger it directly - but no further user interaction or non-default configuration is needed once access is obtained. Impact is confined to confidentiality (VC:H) with no integrity or availability effect, and there is no public exploit code or CISA KEV entry at time of analysis; EPSS is 0.06% (17th percentile), consistent with a moderate-priority, internally-exposed issue rather than an urgent one.
Arbitrary file read in Vitals ESP (Galaxy Software Services) versions 0 through 6.3 lets a remote attacker who already holds a high-privilege account abuse an absolute path traversal in the product's file-retrieval/download functionality to read arbitrary files from the host filesystem, exposing configuration data, credentials and other sensitive content. The flaw is privilege-gated rather than broadly reachable: the vendor-rated CVSS 4.0 score is 6.9 and our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so impact is confined to confidentiality with no integrity or availability effect. Exploitation requires an authenticated high-privilege session, no user interaction and low attack complexity; EPSS is 0.07% (22nd percentile), there is no CISA KEV entry, and no public exploit code identified at time of analysis.