CVE-2024-13150

CVE-2024-13150 describes an SQL Injection in Fayton Software and Consulting Services fayton.Pro ERP. The vulnerability arises from improper neutralization of special elements in SQL commands, enabling potential unauthorized access to the full database. Affected product is fayton.Pro ERP (through ...

CVE-2024-13150

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection. This issue affects fayton.Pro ERP: through 20250929...

CVE-2025-11140

A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed...

CVE-2025-11140

A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed...

CVE-2025-11139

A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has...

CVE-2025-11139 Bjskzy Zhiyou ERP com.artery.form.services.FormStudioUpdater uploadStudioFile path traversal

A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has...

CVE-2025-11139 Bjskzy Zhiyou ERP com.artery.form.services.FormStudioUpdater uploadStudioFile path traversal

A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has...

Bjskzy Zhiyou ERP 代码问题漏洞

Bjskzy Zhiyou ERP is an Enterprise Resource Planning software from Bjskzy Beijing, China. A code issue vulnerability exists in Bjskzy Zhiyou ERP version 11.0 and prior versions, which stems from the incorrect manipulation of the parameter contentString of the function openForm in the component...

PT-2025-39807

Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0 Description A path traversal issue exists in Bjskzy Zhiyou ERP. The uploadStudioFile function within the com.artery.form.services.FormStudioUpdater component is affected. Manipulation of the filepath...

CVE-2024-12796

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS. This issue affects Workcube ERP: from V12 - V14 before Cognitive...

CVE-2024-12796 Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS.This issue affects Workcube ERP: from V12 - V14 before Cognitive...

CVE-2024-12796 Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS. This issue affects Workcube ERP: from V12 - V14 before Cognitive...

PT-2025-37982

Name of the Vulnerable Software and Affected Versions: Workcube ERP versions V12 through V14 through 20250916 Description: Workcube ERP is susceptible to a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Workcube ERP...

Linux Distros Unpatched Vulnerability : CVE-2018-19799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS. CVE-2018-19799 Note that Nessus relies on the presence of the package as reported by t...

Linux Distros Unpatched Vulnerability : CVE-2018-13450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statusbatch...

Linux Distros Unpatched Vulnerability : CVE-2017-7886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. CVE-2017-7886 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2019-19211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS. CVE-2019-19211 Note that Nessus relies on the presence of...

Linux Distros Unpatched Vulnerability : CVE-2021-33618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by and and characters in the onpointermove attribute of a BODY element to the...

Linux Distros Unpatched Vulnerability : CVE-2017-14238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId...

Linux Distros Unpatched Vulnerability : CVE-2017-17897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id...