Erpnext Security Vulnerabilities

CVE-2022-28598

Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other...

CVE-2022-23056

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover...

CVE-2020-6145

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2019-20514

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/...

CVE-2019-20520

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/...

CVE-2019-20521

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/...

CVE-2019-20515

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/...

CVE-2019-20516

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/...

CVE-2019-20517

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/...

CVE-2019-20519

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail...

CVE-2019-20518

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/...

CVE-2019-20511

ERPNext 11.1.47 allows blog?blog_category= Frame...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-3884

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sort_by and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to...

CVE-2018-3885

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The order_by parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger...

CVE-2018-3883

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sort_order parameter can be used to perform an SQL injection attack. An attacker can use a browser.....

CVE-2018-3882

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger...

CVE-2018-11339

An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a...