SQL Injection in Graph Container Parameter

Command Injection in Netflow path

Remote Code Execution leads to Command Injection

Command Injection leading to RCE via LDAP Misconfiguration

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

OS Command injection in Ajax PHP files through HTTP Request

Unauth Time-Based SQL Injection via API

System command injection through Netflow function

Unauth Time-Based SQL Injection

Traversal Path on PHP file

Unauthenticated Admin Account Takeover Via Cron Log File Backups

Insecure Default Initialization in API Authentication leads to Authentication Bypass

OS Command Injection

Server-Side Request Forgery in API Checker leads to Privilege Escalation

Cross-Site Request Forgery on Extension Pages

SQL Injection in Custom Fields leads to Database Compromise

SQL Injection in Module Search leads to Database Compromise

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

OS Command Injection in Network Report leads to Remote Code Execution

QuickShell Authenticated Command Injection

Post-auth Arbitrary File Read in the Server Plugins Section

SQL Injection in CSV Module Data Collection

SQL Injection in Visual Console

Uploading executables via the file manager

Linux Local Privilege Escalation Via GoTTY Page

Remote Code Execution via File Uploader

Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

Session Fixation in Authentication leads to Session Hijacking

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Arbitrary File Read As Root Via GoTTY Page

Misassignment of privileges can cause DOS attack

Arbitrary File Read

CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

SQL Injection in Grafana Integration Endpoint (query.php)

OS Command Injection in Event Response Execution

Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure

Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure

Path Traversal and Untrusted Upload File

Database backups availability by low-privileged users

UnautH SQL Injection

XSS in Visual Console

XSS in File manager

XSS Vulnerability Messages

User notification settings edition

Stored XSS Via Site News Page

Stored XSS Via Dashboard Panel

Lack of Authorization and Stored XSS Via SNMP Trap Editor Page

Unauthenticated Admin Account Takeover Via XSS