Design/Logic Flaw

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

CVE-2019-20511

CVE-2019-20511 affects ERPNext 11.1.47 and is described as a Frame Injection vulnerability via the blog?blog_category parameter. Red Hat/CNVD-style entries corroborate an injection issue stemming from insufficient input validation on user-supplied data; ERPNext’s styling of a blog category parame...

CVE-2019-20511

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

CVE-2019-20511: Improper Neutralization of Input During Web Page Generation

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

ERPNext 11.1.47 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Multiple Reflected Cross-site Scripting Vulnerabilities in ERPNext Affected Software: ERPNext Affected Versions: 11.1.47 Vendor Homepage: https://erpnext.com/ Vulnerability Type: Reflected Cross-site Scripting Severity: High Status:...

Frappe ERPNext SQL Injection Vulnerability (CNVD-2019-17163)

Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in Frappe ERPNext versio...

Sql injection

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

CVE-2018-20061 affects ERPNext 10.x and 11.x up to 11.0.3-beta.29. The issue is a SQL injection caused by calling a server-side Python function via JavaScript, enabling an attacker with a user account (no special privileges) to craft SQL queries and retrieve arbitrary columns from any tables. The...

CVE-2018-20061: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

PT-2018-15246

Name of the Vulnerable Software and Affected Versions ERPNext versions 10.x through 11.0.3-beta.29 Description A SQL injection issue was discovered that allows an attacker to construct SQL queries to return any columns from any tables in the database. This issue is related to the...

CVE-2018-3885

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The orderby parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger thes...

CVE-2018-3884

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sortby and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to...

CVE-2018-3882

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger...

CVE-2018-3883

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...

CVE-2018-3882

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger...

CVE-2018-3883

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...

Sql injection

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...