Escan Management Console vulnerabilities

3 known vulnerabilities in Escan Management Console from Escanav. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Escan Management Console: Cleartext Transmission of Sensitive Information

  CVE-2023-33730May 31, 2023EscanavEPSS 1.18%

  Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any admin or normal user in plain text format.

• 9.0 Critical severity

  Escan Management Console: Improper Neutralization of Input During Web Page Generation

  CVE-2023-31703May 17, 2023EscanavEPSS 4.47%

  Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter.

• 7.2 High severity

  Escan Management Console: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-31702May 17, 2023EscanavEPSS 4.31%

  SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.