2752 matches found
CVE-2017-9838
Dolibarr ERP/CRM (before 5.0.4) is affected by multiple reflected XSS vulnerabilities. Specifically, index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, month_end), and don/card.php (societe, lastname...
CVE-2017-9838
Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...
CVE-2017-18259
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting XSS in versions through 7.0.0...
CVE-2017-9839
Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php type parameter...
Front Accounting ERP 2.4.3 Cross Site Request Forgery
!-- 2 This hosted page upon being clicked by an logged in admin user will lead to creation of a new...
Front Accounting ERP 2.4.3 - Cross-Site Request Forgery Vulnerability
Exploit for php platform in category web applications input type="submit" va...
Front Accounting ERP 2.4.3 - Cross-Site Request Forgery
!-- 2 This hosted page upo...
Front Accounting ERP 2.4.3 - Cross-Site Request Forgery
Front Accounting ERP 2.4.3 - Cross-Site Request Forgery...
CVE-2018-2381
SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...
Authorization
SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...
CVE-2018-2381
CVE-2018-2381 affects SAP ERP Financials components (SAP_APPL 6.00–6.06, 6.16; SAP_FIN 6.17–7.30; S4CORE 1.00–1.02). The issue is insufficient authorization checks for an authenticated user, enabling escalation of privileges within the application. The description consistently states privilege el...
CVE-2018-2381
SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...
Ciesto Solutions ERP System SQL Injection Vulnerability
Ciesto Solutions ERP System suffers from a remote SQL injection vulnerability that allows for authentication bypass. Exploit Title: Ciesto Solutions ERP System - Authentication Bypass Dork: N/A Date: 11.02.2018 Vendor Homepage: https://ciestosolutions.com/ Software Link:...
Ciesto Solutions ERP System SQL Injection
Exploit Title: Ciesto Solutions ERP System - Authentication Bypass Dork: N/A Date: 11.02.2018 Vendor Homepage: https://ciestosolutions.com/ Software Link: https://ciestosolutions.com/system-development/erp-solutions/ Version: N/A Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit...
CVE-2017-17971
The testsqlandscriptinject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS...
Cross site scripting
The testsqlandscriptinject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS...
CVE-2017-17971
The testsqlandscriptinject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS...
CVE-2017-17971
The testsqlandscriptinject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS...
CVE-2017-17971
Dolibarr ERP/CRM 6.0.4 contains an XSS vulnerability in test_sql_and_script_inject within htdocs/main.inc.php. The code blocks some event attributes but does not block onclick or onscroll, enabling injection of arbitrary scripts. The vulnerability is documented across multiple feeds (NVD/CNVD/OSS...