CVE-2019-19210

Dolibarr ERP/CRM vulnerable to Cross‑Site Scripting prior to version 10.0.3. The root cause is that uploaded HTML documents are served as text/html even after being renamed to .noexe files, enabling an attacker to inject and execute script in the victim’s browser. The vulnerability affects Doliba...

CVE-2019-19210

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files...

CVE-2019-19209

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection...

CVE-2019-19209

CVE-2019-19209 affects Dolibarr ERP/CRM prior to 10.0.3, where a SQL Injection flaw exists in the Dolibarr ERP/CRM software. The connected documents consistently describe the vulnerability as a SQL injection in that product/version without detailing exploit vectors, impact scope, or mitigation st...

CVE-2020-6199

The view FIMENAVCOMPCERT in SAP ERP MENA Certificate Management, EAPPGLO version 607, SAPFIN versions- 618, 730 and SAP S/4HANA MENA Certificate Management, S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization grou...

Authorization

The view FIMENAVCOMPCERT in SAP ERP MENA Certificate Management, EAPPGLO version 607, SAPFIN versions- 618, 730 and SAP S/4HANA MENA Certificate Management, S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization grou...

CVE-2020-6199

The view FIMENAVCOMPCERT in SAP ERP MENA Certificate Management, EAPPGLO version 607, SAPFIN versions- 618, 730 and SAP S/4HANA MENA Certificate Management, S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization grou...

CVE-2020-6199

The CVE-2020-6199 entry concerns SAP ERP (MENA Certificate Management) components: EAPPGLO 607, SAP_FIN 618/730, and SAP S/4HANA MENA (S4CORE 100–104). The flaw is a Missing Authorization Check in the view FIMENAV_COMPCERT, allowing an attacker without an authorization group to maintain any compa...

CVE-2020-6188

VAT Pro-Rata reports in SAP ERP SAPAPPL versions 600, 602, 603, 604, 605, 606, 616 and SAPFIN versions 617, 618, 700, 720, 730 and SAP S/4 HANA versions 100, 101, 102, 103, 104 do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check...

Authorization

VAT Pro-Rata reports in SAP ERP SAPAPPL versions 600, 602, 603, 604, 605, 606, 616 and SAPFIN versions 617, 618, 700, 720, 730 and SAP S/4 HANA versions 100, 101, 102, 103, 104 do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check...

CVE-2020-6188

VAT Pro-Rata reports in SAP ERP SAPAPPL versions 600, 602, 603, 604, 605, 606, 616 and SAPFIN versions 617, 618, 700, 720, 730 and SAP S/4 HANA versions 100, 101, 102, 103, 104 do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check...

CVE-2020-6188

The CVE-2020-6188 issue affects SAP ERP (SAP_APPL 600–606, 616; SAP_FIN 617–618, 700, 720, 730) and SAP S/4HANA (100–104). The root cause is missing authorization checks for an authenticated user, as described across multiple sources. This results in a Missing Authorization Check vulnerability wi...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin)

School ERP System 1.0 - Cross Site Request Forgery Add Admin Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link:...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin) Exploit

Exploit for php platform in category web applications Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link:...

School ERP System 1.0 Cross Site Request Forgery

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate Tested on...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin)

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate CVE:...

XSS in Dolibarr ERP & CRM

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header...

GHSA-V384-JQMQ-FC74 XSS in Dolibarr ERP & CRM

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header...

Karakuzu ERP Management Web 5.7.0 - k_adi_duz SQL Injection

Karakuzu ERP Management Web 5.7.0 - kadiduz SQL Injection Exploit Title: Karakuzu ERP Management Web 5.7.0 - 'kadiduz' SQL Injection Discovery Date: 2019-09-20 Exploit Author: Hakan TAŞKÖPRÜ Vendor Homepage: http://karakuzu.info/ Effected Version = 5.7.0 Vulnerability 1: Unauthenticated SQL...

Karakuzu ERP Management Web 5.7.0 - (k_adi_duz) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Karakuzu ERP Management Web 5.7.0 - 'kadiduz' SQL Injection Exploit Author: Hakan TAŞKÖPRÜ Vendor Homepage: http://karakuzu.info/ Effected Version = 5.7.0 Vulnerability 1: Unauthenticated SQL Injection...