50 matches found
CVE-2024-47769
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
CVE-2024-47769
Summary: CVE-2024-47769 affects IDURAR, an open-source ERP/CRM. The vulnerability is in corePublicRouter.js where a public endpoint is accessible to unauthenticated users and user input is directly appended to a join statement, enabling a URL-encoded payload to be processed. This can allow an att...
CVE-2024-47769 IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
CVE-2024-47769 IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
CVE-2024-47769 IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
IDURAR ERP/CRM 安全漏洞
IDURAR ERP/CRM is an open source content management system from the individual developer Salah Eddine Lalami. A security vulnerability exists in IDURAR ERP/CRM versions prior to 2.1.0 that stems from the presence of a path traversal vulnerability, which allows an attacker to send a URL-encoded...
CVE-2024-25164
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality...
Path traversal
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality...
IDURAR ERP/CRM Security Breach
IDURAR ERP/CRM is an open source content management system by Salah Eddine Lalami, an individual developer. A security vulnerability exists in IDURAR ERP/CRM v2.0.0, which stems from a path traversal vulnerability that can be exploited by an attacker to expose sensitive files via the download...
CVE-2024-25164
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality...
PT-2024-20792 · Idurar · Idurar
Name of the Vulnerable Software and Affected Versions: iDURAR version 2.0.0 Description: A Path Traversal vulnerability exists, allowing unauthenticated attackers to expose sensitive files via the download functionality. The issue can be exploited using backslashes. For example, an attacker can u...
CVE-2024-25164
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality...
CVE-2024-25164
CVE-2024-25164 affects iDURAR v2.0.0. A path traversal vulnerability exists in the download function, allowing unauthenticated attackers to expose sensitive files. The Red Hat/NVD/CNNVD/etc. documents corroborate that the issue stems from a path traversal flaw in the download endpoint (example ex...
CVE-2024-25164
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality...
CVE-2023-52265
IDURAR aka idurar-erp-crm through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data...
Cross site scripting
IDURAR aka idurar-erp-crm through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data...
PT-2023-31948 · Idurar · Idurar
Name of the Vulnerable Software and Affected Versions: IDURAR aka idurar-erp-crm versions 2.0.1 and earlier Description: The issue allows stored XSS via a PATCH request with a crafted JSON email template in the "/api/email/update" data. This can be exploited by sending a specially crafted request...
CVE-2023-52265
CVE-2023-52265 affects IDURAR (idurar-erp-crm)
IDURAR ERP/CRM Cross-Site Scripting Vulnerability
IDURAR ERP/CRM is an open source content management system from the individual developer Salah Eddine Lalami. A cross-site scripting vulnerability exists in IDURAR ERP/CRM 2.0.1 and prior versions, which originates from the ability to execute cross-site scripting via the Edit Email Template featu...