Deltaww Diaenergie vulnerabilities
92 vulnerabilities
Known vulnerabilities in Deltaww Diaenergie, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-31558delta electronicsdiaenergie+1
EPSS score10.56%
DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAE_hierarchyHandler.ashx”.CVE-2021-38391deltawwdiaenergieEPSS score3.45%
A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.CVE-2021-38393deltawwdiaenergieEPSS score18.46%
A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.CVE-2021-38390deltawwdiaenergieEPSS score19.77%
A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.CVE-2021-44544delta electronicsdiaenergie+1EPSS score9.49%
DIAEnergie Version 1.7.5 and prior is vulnerable to multiple cross-site scripting vulnerabilities when arbitrary code is injected into the parameter “name” of the script “HandlerEnergyType.ashx”.CVE-2021-44471delta electronicsdiaenergie+1EPSS score0.70%
DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “name” of the script “DIAE_HandlerAlarmGroup.ashx”.CVE-2021-32955deltawwdiaenergieEPSS score37.32%
Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code.CVE-2021-32991deltawwdiaenergieEPSS score0.36%
Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an action unintentionally.CVE-2021-32983deltawwdiaenergieEPSS score3.94%
A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter keyword before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.CVE-2021-32967deltawwdiaenergieEPSS score1.38%
Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which may allow the attacker to log in and use the device with administrative privileges.CVE-2021-33003deltawwdiaenergieEPSS score0.17%
Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm.CVE-2021-23228delta electronicsdiaenergie+1EPSS score0.64%
DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”.CVE-2025-57701delta electronicsdiaenergie+1EPSS score0.16%
DIAEnergie - Reflected Cross-site ScriptingCVE-2025-57702delta electronicsdiaenergie+1EPSS score0.16%
DIAEnergie - Reflected Cross-site ScriptingCVE-2025-57700delta electronicsdiaenergie+1EPSS score0.18%
DIAEnergie - Stored Cross-site ScriptingCVE-2025-57703delta electronicsdiaenergie+1EPSS score0.16%
DIAEnergie - Reflected Cross-site ScriptingCVE-2022-40965delta electronicsdiaenergie+1EPSS score11.11%
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API.CVE-2022-40967delta electronicsdiaenergie+1EPSS score7.69%
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.CVE-2022-1366delta electronicsdiaenergie+1EPSS score19.35%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.CVE-2022-1378delta electronicsdiaenergie+1EPSS score19.35%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.