708 matches found
CVE-2018-3883: Improper Neutralization of Special Elements used in an SQL Command
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...
PT-2018-16278
Name of the Vulnerable Software and Affected Versions ERPNext version 10.1.6 Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause SQL injections, resulting in data compromise. The order by parameter can be used t...
PT-2018-16275
Name of the Vulnerable Software and Affected Versions ERPNext version 10.1.6 Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause SQL injections, resulting in data compromise. The searchfield parameter can be use...
Frappe ERPNext SQL Injection Vulnerability
Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in the 'sortby' paramete...
Frappe ERPNext SQL Injection Vulnerability (CNVD-2019-17165)
Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in the 'employee'...
Frappe ERPNext SQL Injection Vulnerability (CNVD-2019-17164)
Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in the 'searchfield'...
Vulnerability Spotlight: TALOS-2018-0560 - ERPNext SQL Injection Vulnerabilities
Vulnerabilities discovered by Yuri Kramar from the Cisco Security Advisor Team Overview Talos is disclosing multiple SQL injection vulnerabilities in the Frappe ERPNext Version 10.1.6 application. Frappe ERPNext is an open-source enterprise resource planning ERP cloud application. These...
ERPNext SQL Injection Vulnerabilities
Summary Exploitable SQL injection vulnerabilities exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required. Tested...
Frappe ERPNext Cross-Site Scripting Vulnerability
Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A cross-site scripting vulnerability exists in Frappe ERPNext...
Cross site scripting
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
CVE-2018-11339
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
CVE-2018-11339
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
CVE-2018-11339
CVE-2018-11339 describes a Cross-Site Scripting (XSS) vulnerability in Frappe ERPNext v11.x.x-develop (commit b1036e5) exploitable via the Comment functionality. Public sources confirm that arbitrary script payloads can be injected, demonstrating stored/reflected/cookie-based XSS vectors in ERPNe...
CVE-2018-11339
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
CVE-2018-11339
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
ERPnext 11 - Cross-Site Scripting Vulnerability
Exploit for java platform in category web applications Exploit Title: ERPnext 11.x.x - Cross-Site Scripting Exploit Author: Veerababu Penugonda Vendor Homepage: https://erpnext.com/ Software Link: https://demo.erpnext.com/ Version: Frappe ERPNext v11.x.x-develop Tested on: Mozilla Firefox quantum...
ERPnext 11.x.x Cross Site Scripting
Exploit Title: ERPnext 11.x.x - Cross-Site Scripting Date: 2018-05-10 Exploit Author: Veerababu Penugonda Vendor Homepage: https://erpnext.com/ Software Link: https://demo.erpnext.com/ Version: Frappe ERPNext v11.x.x-develop Tested on: Mozilla Firefox quantum 60.1 , Ubuntu OS CVE : CVE-2018-11339...
ERPnext 11 - Cross-Site Scripting
ERPnext 11 - Cross-Site Scripting Exploit Title: ERPnext 11.x.x - Cross-Site Scripting Date: 2018-05-10 Exploit Author: Veerababu Penugonda Vendor Homepage: https://erpnext.com/ Software Link: https://demo.erpnext.com/ Version: Frappe ERPNext v11.x.x-develop Tested on: Mozilla Firefox quantum 60....
PT-2018-10496
Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to the fixed version Description A cross-site scripting XSS issue was discovered in Frappe ERPNext. The issue is related to a comment. Recommendations At the moment, there is no information about a newer version...