Delta Electronics Diaenergie vulnerabilities, page 3
69 vulnerabilities
Known vulnerabilities in Delta Electronics Diaenergie, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-0923delta electronicsdiaenergie+1
EPSS score1.04%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.CVE-2022-0988delta electronicsdiaenergie+1EPSS score0.52%
Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.CVE-2022-25347delta electronicsdiaenergie+1EPSS score11.39%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system.CVE-2022-25980delta electronicsdiaenergie+1EPSS score1.22%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.CVE-2022-25880delta electronicsdiaenergie+1EPSS score1.22%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.CVE-2022-43452delta electronicsdiaenergie+1EPSS score7.69%
SQL Injection in
FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetworkCVE-2022-43457delta electronicsdiaenergie+1EPSS score0.66%
SQL Injection in
HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetworkCVE-2022-43506delta electronicsdiaenergie+1EPSS score0.73%
SQL Injection in
HandlerTag_KID.ashx
in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetworkCVE-2022-43447delta electronicsdiaenergie+1EPSS score0.66%
SQL Injection in
AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetworkCVE-2022-27175delta electronicsdiaenergie+1EPSS score1.22%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.CVE-2024-42417delta electronicsdiaenergie+1EPSS score7.03%
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.CVE-2024-4549delta electronicsdiaenergie+1EPSS score1.11%
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.CVE-2024-4548delta electronicsdiaenergie+1EPSS score29.43%
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.CVE-2024-4547delta electronicsdiaenergie+1EPSS score1.90%
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth fieldCVE-2024-25567delta electronicsdiaenergie+1EPSS score0.66%
Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.CVE-2024-25574delta electronicsdiaenergie+1EPSS score8.79%
SQL injection vulnerability exists in GetDIAE_usListParameters.CVE-2024-25937delta electronicsdiaenergie+1EPSS score8.48%
SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.CVE-2024-43699delta electronicsdiaenergie+1EPSS score0.54%
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.CVE-2024-28045delta electronicsdiaenergie+1EPSS score0.29%
Improper neutralization of input within the affected product could lead to cross-site scripting.CVE-2024-28891delta electronicsdiaenergie+1EPSS score8.48%
SQL injection vulnerability exists in the script Handler_CFG.ashx.