CVE-2019-19994

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by injecting the vulnerable parameter in the PHP Web page /common/vam_monitor_sap.php.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.seling.it/Product
https://www.seling.it/product/vam/Product, Vendor Advisory
https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.htmlExploit, Third Party Advisory
https://www.seling.it/Product
https://www.seling.it/product/vam/Product, Vendor Advisory
https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.htmlExploit, Third Party Advisory

Timeline

Published: Feb 26, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-199958.8A CSRF issue was discovered on Intelbras IWR 3000N 1.8.7 devices, leading to complete control of the router, as demonstrated by v1/system/us CVE-2019-199967.5An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. A malformed login request allows remote attackers to cause a denial of service CVE-2019-199987.5Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.CVE-2019-199997.2Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMa CVE-2019-20007.8In several functions of binder.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privil CVE-2019-200005.9The malware scan function in BullGuard Premium Protection 20.0.371.8 has a TOCTOU issue that enables a symbolic link attack, allowing privil CVE-2019-200017.8An issue was discovered in RICOH Streamline NX Client Tool and RICOH Streamline NX PC Client that allows attackers to escalate local privile CVE-2019-200027.8Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subjec CVE-2019-200036.1Feldtech easescreen Crystal 9.0 Web-Services 9.0.1.16265 allows Stored XSS via the Debug-Log and Display-Log components. This could be explo CVE-2019-200048.8An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. When the administrator password is changed from a certain client IP address, a CVE-2019-200056.5An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory CVE-2019-200067.5An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content puts a pointer to the internal address of a larger blo