28464 matches found
CVE-2025-57529
creationtimestamp| type| source ---|---|--- 2025-09-30 02:57:56+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/53602 2025-10-18 09:50:45+00:00| seen| https://t.me/NinjaSec/424 2026-02-04 16:57:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2duahplb2r...
CVE-2025-52050
In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...
CVE-2025-52050
In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...
CVE-2025-52050
In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...
CVE-2025-52050
Frappe ERPNext version 15.57.5 is vulnerable to SQL Injection within the get_loyalty_program_details_with_points() function located at erpnext/accounts/doctype/loyalty_program/loyalty_program.py. The root cause is insufficient validation of the expiry_date parameter. An attacker can exploit this ...
Frappe Technologies Frappe 安全漏洞
Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe version 15.57.5, which stems from insufficient validation of the expirydate parameter and...
PT-2025-39992
Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The get loyalty program details with points function located at erpnext/accounts/doctype/loyalty program/loyalty program.py is susceptible to SQL Injection. An attacker can inject a SQL query into the...
CVE-2025-35030
Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08...
CVE-2025-35031
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08...
CVE-2025-35032
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08...
CVE-2025-35034
Medical Informatics Engineering Enterprise Health is affected by a reflected cross-site scripting vulnerability in the portlet_user_id URL parameter. A remote, unauthenticated attacker can craft a URL to execute arbitrary JavaScript in a victim’s browser. The issue is fixed as of 2025-03-14. Acco...
CVE-2025-35031
Medical Informatics Engineering Enterprise Health is affected by CVE-2025-35031, where the software includes the user’s current session token in debug output. This enables an attacker to impersonate the user if the token is exfiltrated (e.g., via the user sending debug output). The issue is fixed...
CVE-2025-60093
creationtimestamp| type| source ---|---|--- 2025-09-29 17:01:10+00:00| seen| Telegram/aS2NF6cfAcIzS5IvvBcwEaBPnqehzkRWs0HUBmS6voJdLp0...
CVE-2025-60092
creationtimestamp| type| source ---|---|--- 2025-09-29 17:01:09+00:00| seen| Telegram/zbHRJcABxnT9ljt1um58u91lGqDe58FmjyBFp7fEaw7HE8...
CVE-2024-13150
CVE-2024-13150 describes an SQL Injection in Fayton Software and Consulting Services fayton.Pro ERP. The vulnerability arises from improper neutralization of special elements in SQL commands, enabling potential unauthorized access to the full database. Affected product is fayton.Pro ERP (through ...
Libsoup: out-of-bounds read in cookie date handling of libsoup http library
...
CVE-2025-11123
creationtimestamp| type| source ---|---|--- 2025-09-29 00:03:15+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lzwpidycjo26...
PT-2025-39871
Name of the Vulnerable Software and Affected Versions Medical Informatics Engineering Enterprise Health affected versions not specified Description The software contains a cross site request forgery condition. An unauthenticated attacker can deceive administrative users into clicking a specially...
PT-2025-39873
Name of the Vulnerable Software and Affected Versions Medical Informatics Engineering Enterprise Health versions prior to 2025-04-08 Description Authenticated users are able to upload arbitrary files. The impact of this behavior is dependent on how these files are accessed. Approximately 2000...