Dolibarr ERP CMS `list.php` - SQL Injection

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. id: CVE-2024-5315 info: name: Dolibarr ERP CMS list.php - SQL Injection author: rootxharsh,iamnoooob,pdresearch severity: critical description: | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0....

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2711 info: name: Yonyou UFIDA ERP-NC V5.0 -...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2709 info: name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scriptin...

CVE-2023-2744

Exploit Title: WP Plugins WP ERP = 1.12.2 - SQL Injection Date: 15-10-2023 Exploit Author: Arvandy Software Link: https://wordpress.org/plugins/erp/ Vendor Homepage: https://wperp.com/ Version: 1.12.2 Tested on: Windows, Linux CVE: CVE-2023-2744 Product Description...

CVE-2022-32118

CVE-2022-32118 - Arox-XSS Vulnerabilità di Cross Site Scripting XSS persistente Stored e riflesso Reflected sono presenti in diverse pagine dell'applicazione Arox School ERP Pro, inclusa la pagina di login, e consentono l'esecuzione arbitraria di comandi JavaScript. L'applicazione presenta molti...

CVE-2023-27742

CVE-2023-27742 Es wurde festgestellt, dass IDURAR ERP/CRM v1 eine SQL-Injection-Schwachstelle über die Komponente /api/login aufweist. Beschreibung Es wurde festgestellt, dass IDURAR ERP/CRM v1 eine SQL-Injection-Schwachstelle über die Komponente /api/login aufweist. Schwachstellentyp SQL-Injecti...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite = 1.17.7 Upload Arbitrário de Arquivo Não Autenticado via Anexo de E-mail do CRM Email Connect Path Traversal → RCE...

CVE-2026-35678

Rapporto di Ricerca sulle Vulnerabilità: Insecure Direct Object Reference IDOR Universale in Eduplus Student ERP Ricercatore: Vinay Sharma 1. Sintesi Esecutiva Questo rapporto descrive una vulnerabilità di sicurezza ad alta gravità identificata nella piattaforma Eduplus Student ERP, in particolar...

CVE-2025-50565

CVE-2025-50565 Descrizione Doubo ERP 1.0 presenta una vulnerabilità di SQL injection dovuta alla mancanza di filtraggio dell'input utente, che può essere sfruttata da remoto da un attaccante. Tipo di vulnerabilità SQL Injection Tipo di attacco Remoto Impatto divulgazione di informazioni true Vend...

CVE-2026-81031

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

EUVD-2026-66607

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031

CVE-2026-81031 affects IDURAR ERP CRM through version 4.1.1 . The vulnerability resides in the password update handler (updatePassword.js), which applies a password change to the identifier in the URL path rather than verifying it matches the authenticated user. Because the route requires only a ...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin (versions ≤ 1.17.8) is vulnerable to an unauthenticated arbitrary file upload via the CRM Email Connect IMAP attachment processing. The root cause is missing file extension validation and path normalization in the...

EUVD-2026-66408

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

WordPress ERP plugin <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment vulnerability

Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment vulnerability discovered by Talal Nasraddeen in WordPress Plugin WP ERP versions = 1.17.8...

PT-2026-82219

Name of the Vulnerable Software and Affected Versions IDURAR ERP CRM affected versions not specified Description An issue exists where the system changes the password of any account specified in a request instead of the account making the request. The update handler in...