Gss vulnerabilities
Published CVEs affecting Gss products: 5 record(s), with severity, exploitation and fixes.
CVE-2026-4640
High · 7.5
CWE-306 Mar 24, 2026
Galaxy Software Services｜Vitals ESP - Missing Authentication
Vitals ESP developed by Galaxy Software Services has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to execute certain functions to obtain sensitive information.
CVE-2026-4639
High · 8.8
CWE-863 Mar 24, 2026
Galaxy Software Services｜Vitals ESP - Incorrect Authorization
Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative functions, thereby escalating privileges.
CVE-2025-14255
Medium · 6.5
CWE-89 Dec 8, 2025
Galaxy Software Services｜Vitals ESP - SQL Injection
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVE-2025-14254
Medium · 6.5
CWE-89 Dec 8, 2025
Galaxy Software Services｜Vitals ESP - SQL Injection
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVE-2025-14253
Medium · 4.9
CWE-36 Dec 8, 2025
Galaxy Software Services｜Vitals ESP - Arbitrary File Read
Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.