31 matches found
CVE-2025-56380
CVE-2025-56380 โ Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue ๐ Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...
EUVD-2018-11243
Malware in sbrugna...
EUVD-2022-6568
Malicious code in bioql PyPI...
EUVD-2025-32134
Malicious code in bioql PyPI...
CVE-2025-56380
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...
CVE-2025-56380
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...
CVE-2025-56380
A time-based blind SQL injection vulnerability (CWE-89) exists in the Frappe Framework (v15.72.4) and ERPNext (v15.67.0) within the frappe.client.get_value API endpoint. The root cause is the improper sanitization and concatenation of the fieldname parameter into SQL queries. An authenticated use...
PT-2025-40353
Name of the Vulnerable Software and Affected Versions Frappe Framework version 15.72.4 Description A SQL injection issue exists in Frappe Framework. The issue is located in the fieldname parameter of the frappe.client.get value API endpoint. A crafted script provided to the fieldname parameter ca...
๐ ERPNext 15.67.0 / Frappe 15.72.4 Blind SQL Injection
A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework version 15.72.4 and it is also present in ERPNext version 15.67.0. An authenticated user with access to the reporting/client API can inject SQL via the fieldname parameter...
Frappe Technologies Frappe Framework ๅฎๅ จๆผๆด
Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe Framework version 15.72.4, which stems from an SQL injection in the fieldnam...
CVE-2025-56380
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...
CVE-2025-56380
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...
CVE-2025-56380: Improper Neutralization of Special Elements used in an SQL Command
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...
CVE-2025-56380
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...
CVE-2022-36272
Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter...
Faculty Management System SQL Injection Vulnerability
Faculty Management System is a code-projects open source faculty management system . Faculty Management System version 1.0 SQL injection vulnerability , the vulnerability stems from /admin/php/crud.php in the presence of an unknown function , through the parameter fieldname lead to SQL injection...
PT-2023-32870
Name of the Vulnerable Software and Affected Versions code-projects Faculty Management System version 1.0 Description A critical issue affects some unknown functionality of the file /admin/php/crud.php. The manipulation of the fieldname argument leads to sql injection. The attack may be launched...
CVE-2023-37826
A cross-site scripting XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter...
CVE-2023-37826
A cross-site scripting XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter...
CVE-2023-37826
A cross-site scripting XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter...