68 matches found
EUVD-2026-96898
Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method wit...
CVE-2026-108732
The Frappe HR (hrms) application before version 16.11.0 (including all 14.x and 15.x releases through 15.64.3 ) contains a missing authorization vulnerability. The flaw exists in the whitelisted get_account_and_amount method, which allows authenticated users without HR roles to access sensitive d...
CVE-2026-108732 Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method wit...
CVE-2026-4894
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an...
CVE-2026-4894
Multiple products from Frappe Technologies , specifically Frappe Cloud/ERPNext , are vulnerable to an authentication bypass due to insufficient validation in the authentication process. An unauthenticated remote attacker can manipulate the email field in the /api/method/press.api.account.signup e...
CVE-2026-4894 Authentication bypass in multiple products from Frappe Technologies
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an...
CVE-2026-7726
The CVE describes an unauthenticated vulnerability in the WordPress plugin Layouts for WPBakery
EUVD-2026-24601
The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method...
CVE-2026-6834
The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method...
CVE-2026-6834
The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method...
CVE-2026-6834
Technical details about CVE-2026-6834 are not publicly provided in the supplied documents. No affected products, versions, impact, or remediation are detailed here; monitor for updates.
PT-2026-34247
CVE-2026-6834 The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specif… https://t.co/30wrzM11aW...
CVE-2020-12834
eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...
CVE-2019-20520
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/method/ URI...
EUVD-2016-6355
Malware in sbrugna...
EUVD-2019-11064
Malware in sbrugna...
EUVD-2014-8877
Malware in sbrugna...
EUVD-2025-2571
Malicious code in bioql PyPI...