510 matches found
EUVD-2022-28166
Malicious code in bioql PyPI...
EUVD-2025-31734
Malicious code in bioql PyPI...
EUVD-2022-28168
Malicious code in bioql PyPI...
EUVD-2025-31737
Malicious code in bioql PyPI...
EUVD-2025-32136
Malicious code in bioql PyPI...
EUVD-2025-31736
Malicious code in bioql PyPI...
EUVD-2025-29577
Malicious code in bioql PyPI...
EUVD-2022-28165
Malicious code in bioql PyPI...
EUVD-2025-31735
Malicious code in bioql PyPI...
EUVD-2025-32006
Malicious code in bioql PyPI...
EUVD-2022-28167
Malicious code in bioql PyPI...
EUVD-2025-32017
Malicious code in bioql PyPI...
EUVD-2025-32011
Malicious code in bioql PyPI...
EUVD-2025-32133
Malicious code in bioql PyPI...
CVE-2025-56381
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the orderby and groupby parameters...
CVE-2025-56379
A stored cross-site scripting XSS vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field...
📄 ERPNext 15.67.0 / Frappe 15.72.4 Cross Site Scripting
ERPNext version 15.67.0 and Frappe version 15.72.4 suffer from a persistent cross site scripting vulnerability. CVE-2025-56379 — Stored Cross-Site Scripting XSS in ERPNext 15.67.0 / Frappe 15.72.4 📌 Summary A stored Cross‑Site Scripting XSS vulnerability exists in the Blog module of ERPNext...
CVE-2025-56379
A stored cross-site scripting XSS vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field...
CVE-2025-56381
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the orderby and groupby parameters...
CVE-2025-52040
In Frappe ERPNext 15.57.5, the function getblanketorders at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanketordertype parameter...