CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
BQE BillQuick Web Suite SQL Injection Remote Code Execution Vulnerability (CVE-2021-42258) Technical Advisory
[Affected Scope] BQE BillQuick Web Suite 2018 through 2021 before version 22.0.9.1
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with MSSQLSERVER$ privileges via SQL injection and xp_cmdshell activation, potentially deploying ransomware
[Mitigation] Immediately upgrade BillQuick Web Suite to version 22.0.9.1 or higher, disable xp_cmdshell on the database, and apply WAF rules
QNAP HBS 3 (Hybrid Backup Sync) Improper Authorization Vulnerability (CVE-2021-28799) Security Advisory
[Affected Scope] QNAP HBS 3 (Hybrid Backup Sync) running on QTS, QuTS hero, and QuTScloud operating systems
[Impact] Unauthenticated remote attackers can exploit improper authorization to log in to the device with administrative privileges, potentially leading to full system compromise
[Mitigation] Immediately update HBS 3 to the patched versions and restrict external internet access to the NAS management interface
Kaseya VSA ConnectWise ManagedITSync Integration Unauthenticated SQL Injection and Remote Code Execution (CVE-2017-18362)
[Affected Scope] ConnectWise ManagedITSync integration through 2017 for Kaseya VSA with exposed ManagedIT.asmx page
[Impact] Unauthenticated remote attackers can execute arbitrary SQL queries (read/write) on the Kaseya VSA database, leading to full system compromise and ransomware deployment across all managed endpoints
[Mitigation] Immediately restrict external access to the ManagedIT.asmx page, apply official security patches, or disable the integration if not in use