Dolibarr ERP CMS `list.php` - SQL Injection

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. id: CVE-2024-5315 info: name: Dolibarr ERP CMS list.php - SQL Injection author: rootxharsh,iamnoooob,pdresearch severity: critical description: | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0....

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2711 info: name: Yonyou UFIDA ERP-NC V5.0 -...

St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2709 info: name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scriptin...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2712 info: name: Yonyou UFIDA ERP-NC V5.0 -...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2710 info: name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting author:...

CVE-2024-41505

CVE-2024-41505 CVE: CVE-2024-41505 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Versión: 20240627-0 Vulnerabilidad: Cross-Site Scripting almacenado XSS Descripción: XSS almacenado en la sección "Pessoas" a través del campo "Profissão" al crear o editar una persona física. Se ejecuta cada...

CVE-2026-94387

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where oldvalue and newvalue entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, includi...

CVE-2026-94387 Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where oldvalue and newvalue entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, includi...

OpenSource-ERP-SQL-Injection

OpenSource-ERP-SQL-Injection La aplicación OpenSource ERP tiene una vulnerabilidad de inyección SQL. CVE-2019-5893 https://vulners.com/cve/CVE-2019-5893 https://www.exploit-db.com/exploits/46118 PoC - Obtener nombre de la BD root@kitploit: POST /db/utils/query/data.xml HTTP/1.1 User-Agent:...

CVE-2024-41502

CVE-2024-41502 CVE: CVE-2024-41502 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Versión: 20240627-0 Vulnerabilidad: Cross-Site Scripting Almacenado XSS Descripción: XSS almacenado a través del campo de formulario "Observações" en la sección "Pessoas" al crear o editar una persona jurídica...

CVE-2023-2744

Título del Exploit: WP Plugins WP ERP = 1.12.2 - Inyección SQL Fecha: 15-10-2023 Autor del Exploit: Arvandy Enlace del software: https://wordpress.org/plugins/erp/ Página del proveedor: https://wperp.com/ Versión: 1.12.2 Probado en: Windows, Linux CVE: CVE-2023-2744 Descripción del producto...

EUVD-2026-82606

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-93454

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-93454 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-93454

Aureus ERP through 1.6.0 contains a stored XSS in the Accounting plugin's Payment Term note field. The field is stored unsanitized and rendered as raw HTML, allowing any authenticated user with payment-term create permission to inject arbitrary JavaScript via the payment-terms endpoint. The paylo...

CVE-2026-93454 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-35678

Informe de Investigación de Vulnerabilidad: Referencia Directa a Objetos Insegura IDOR en Todo Eduplus Student ERP Investigador: Vinay Sharma 1. Resumen Ejecutivo Este informe detalla una vulnerabilidad de seguridad de alta severidad identificada en la plataforma Eduplus Student ERP,...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite = 1.17.7 Subida Arbitraria de Archivos sin Autenticación mediante Adjuntos IMAP de CRM Email Connect Path Traversal → RCE...

CVE-2025-50565

CVE-2025-50565 Description Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. Vulnerability Type SQL Injection Attack Type Remote Impact Information Disclosure true Has vendor confirmed true Discoverer...