Product:

Diaenergie

(Deltaww)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 68
Date Id Summary Products Score Patch Annotated
2022-10-26 CVE-2022-43774 The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. Diaenergie 9.8
2022-10-26 CVE-2022-43775 The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. Diaenergie 9.8
2024-04-01 CVE-2024-25574 SQL injection vulnerability exists in GetDIAE_usListParameters. Diaenergie 9.8
2024-05-03 CVE-2024-34031 Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed. Diaenergie 8.8
2024-05-03 CVE-2024-34032 Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed. Diaenergie 8.8
2024-05-03 CVE-2024-34033 Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten. Diaenergie 8.8
2024-03-21 CVE-2024-25937 SQL injection vulnerability exists in the script DIAE_tagHandler.ashx. Diaenergie 8.8
2021-08-30 CVE-2021-32955 Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code. Diaenergie 9.8
2021-08-30 CVE-2021-32967 Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which may allow the attacker to log in and use the device with administrative privileges. Diaenergie 9.8
2021-08-30 CVE-2021-38393 A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER. Diaenergie 9.8