Galaxy Software Services vulnerabilities
Published CVEs affecting Galaxy Software Services products: 6 record(s), with severity, exploitation and fixes.
CVE-2026-4640
High · 7.5
CWE-306 Mar 24, 2026
Galaxy Software Services｜Vitals ESP - Missing Authentication
Vitals ESP developed by Galaxy Software Services has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to execute certain functions to obtain sensitive information.
CVE-2026-4639
High · 8.8
CWE-863 Mar 24, 2026
Galaxy Software Services｜Vitals ESP - Incorrect Authorization
Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative functions, thereby escalating privileges.
CVE-2025-14255
Medium · 6.5
CWE-89 Dec 8, 2025
Galaxy Software Services｜Vitals ESP - SQL Injection
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVE-2025-14254
Medium · 6.5
CWE-89 Dec 8, 2025
Galaxy Software Services｜Vitals ESP - SQL Injection
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVE-2025-14253
Medium · 4.9
CWE-36 Dec 8, 2025
Galaxy Software Services｜Vitals ESP - Arbitrary File Read
Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
CVE-2025-31342
Critical · 9.3
CWE-434 Oct 20, 2025
Galaxy Software Services Vitals ESP Forum Module - Unrestricted Upload of File with Dangerous Type
An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file.