Supremainc vulnerabilities
We track 7 vulnerabilities in Supremainc products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
Latest Supremainc vulnerabilities
- 7.7 High severity
BioStar 2: Cleartext Transmission of Sensitive Information
An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.
- 8.8 High severity
Biostar 2: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbitrary SQL directives into an SQL statement and execute arbitrary SQL commands.
- 7.5 High severity
Biostar 2: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web server.
- 8.8 High severity
Biostar 2: Improper Neutralization of Special Elements used in an OS Command
An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioStar 2 server.
- 7.5 High severity
Biostar 2: Improper Authentication
An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 servers.
- 8.8 High severity
Biostar 2: Improper Preservation of Permissions
Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server
- 8.8 High severity
Biostar 2: Improper Privilege Management
A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page.