Vulnerability Spotlight: Vulnerabilities in Lansweeper could lead to Java Script, SQL injections
Summary: Cisco Talos discovered multiple vulnerabilities in Lansweeper's IT asset management solution, in .aspx files, that could let an attacker inject SQL or JavaScript code via specially crafted HTTP requests. Three flaws (CVE-2022-22149, CVE-2022-21234, CVE-2022-21210) enable SQL injection and require authentication and proper permissions, while CVE-2022-21145 enables cross-site scripting; Lansweeper 9.2.0 contains the fixes, and version 9.1.20.2 was confirmed affected.
Why it matters: The tool your team uses to inventory and audit every device on the network is itself reachable through crafted HTTP requests, and the SQL injection flaws only need an authenticated account with the right permissions - so a single compromised low-privilege login becomes a path into the asset system of record.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-21145CVE-2022-21210CVE-2022-21234CVE-2022-22149
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026