510 matches found
ERPNext 12.14.0 - SQL Injection (Authenticated)
Exploit Title: ERPNext 12.14.0 - SQL Injection Authenticated Date: 21-01-21 Exploit Author: Hodorsec Vendor Homepage: http://erpnext.org Software Link: https://erpnext.org/download Version: 12.14.0 Tested on: Ubuntu 18.04 !/usr/bin/python3 AUTHENTICATED SQL INJECTION VULNERABILITY In short: Found...
ERPNext frappe.desk.reportview.get SQL injection vulnerability
Talos Vulnerability Report TALOS-2020-1091 ERPNext frappe.desk.reportview.get SQL injection vulnerability August 18, 2020 CVE Number CVE-2020-6145 SUMMARY An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can...
CVE-2020-6145
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2020-6145
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...
Sql injection
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2020-6145
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2020-6145
CVE-2020-6145 affects ERPNext 11.1.38 via the function frappe.desk.reportview.get . The vulnerability is an SQL injection caused by unsafely handling inputs in the request (e.g., POST data) that flows into database queries, potentially enabling an attacker with authenticated access to manipulate ...
ERPNext SQL Injection Vulnerability (CNVD-2020-44886)
ERPNext is an open source enterprise resource planning solution from ERPNext India. A SQL injection vulnerability exists in the 'frappe.desk.reportview.get' function in ERPNext version 11.1.38. The vulnerability stems from a lack of validation of externally entered SQL statements in database-base...
ERPNext Cross-Site Scripting Vulnerability
ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...
ERPNext cross-site scripting vulnerability (CNVD-2020-19000)
ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...
ERPNext Reflective Cross-Site Scripting Vulnerability
ERPNext is a free, open source, integrated enterprise resource planning software. A reflected cross-site scripting vulnerability exists in ERPNext 11.1.47. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the PATHINFO of the blog/ URI...
ERPNext Cross-Site Scripting Vulnerability (CNVD-2020-25805)
ERPNext is a free, open source, integrated enterprise resource planning software. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability ...
ERPNext cross-site scripting vulnerability (CNVD-2020-19004)
ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...
ERPNext cross-site scripting vulnerability (CNVD-2020-19002)
ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...
ERPNext Reflective Cross-Site Scripting Vulnerability (CNVD-2020-18553)
ERPNext is a free, open source, integrated enterprise resource planning software. A reflected cross-site scripting vulnerability exists in ERPNext 11.1.47. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the PATHINFO of the addresses/ URI...
ERPNext cross-site scripting vulnerability (CNVD-2020-19003)
ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...
CVE-2019-20517
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the contact/ URI...
CVE-2019-20515
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...
CVE-2019-20516
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the blog/ URI...
CVE-2019-20520
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/method/ URI...