CVE-2023-54406 Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts

Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.insafeexec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server...

CVE-2023-54406

Frappe versions prior to 14.59.0 and 15.x before 15.5.0 are vulnerable to a sandbox flaw where the frappe.flags.in_safe_exec global flag can be set to False during Server Script execution. This occurs when one server script triggers another, such as by saving a document. Authenticated high-privil...

CVE-2023-54406 Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts

Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.insafeexec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server...

CVE-2023-54406 Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts

Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.insafeexec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server...

PT-2026-67025

Name of the Vulnerable Software and Affected Versions Everest Toolkit versions prior to 1.2.4 Description Insufficient validation of uploaded file types occurs during the demo-content import process because the WordPress file-type test is disabled. This allows high-privilege users, such as...

CVE-2026-27891

FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leadi...

EUVD-2023-60566

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the...

CVE-2023-54345 Frappe Framework ERPNext 13.4.0 Remote Code Execution

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the...

ERPNext Code Injection Vulnerability

ERPNext is a set of open-source enterprise resource planning solutions developed by the Indian company ERPNext. Version 13.4.0 of ERPNext contains a code injection vulnerability. This vulnerability stems from a sandbox escape vulnerability present in RestrictedPython. It allows authenticated user...

Fedora 43 : linux-sgx (2026-a84e0ad039)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a84e0ad039 advisory. Update nodejs modules used by pccs daemon for CVE-2026-23745, CVE-2026-23950, CVE-2026-24842, CVE-2025-13465, CVE-2025-15284. Remove Fedora override...

CVE-2020-37090

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server...

CVE-2022-50907

e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution...

CVE-2024-58280 CMSimple 5.15 Remote Command Execution via Extensions Configuration

CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensionsuserfiles and upload a shell script to the media directory to execute arbitrary code on the server...

WBCE CMS code-related vulnerabilities

WBCE CMS is a PHP and MySQL based open source content management system CMS from WBCE CMS Open Source. A code issue vulnerability exists in WBCE CMS version 1.6.2 that originates from an authenticated user being able to upload malicious PHP files via the Elfinder file manager, which could lead to...

CMSimple security vulnerabilities

CMSimple is a free content management system from CMSimple Open Source. A security vulnerability exists in CMSimple version 5.15 that originates from an authenticated user being able to modify file extensions and upload malicious PHP files, which could lead to remote command execution...

PT-2025-47482

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:F2MAdminF2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs...

EUVD-2025-197936

The Category and Product Woocommerce Tabs plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0. This is due to insufficient input validation on the 'template' parameter in the categoryProductTab function. This makes it possible for authenticated...

PT-2025-46942

Name of the Vulnerable Software and Affected Versions Creta Testimonial Showcase WordPress plugin versions prior to 1.2.4 Description The Creta Testimonial Showcase WordPress plugin is susceptible to a Local File Inclusion issue. Attackers with editor-level access or higher can include and execut...

QDocs Smart School Management System security vulnerabilities

QDocs Smart School Management System is a smart group building system from QDocs, Inc. A security vulnerability exists in QDocs Smart School Management System version 7.1, which stems from a logic flaw that allows bypassing file type restrictions and could result in uploading arbitrary PHP files...

PT-2025-39889

Name of the Vulnerable Software and Affected Versions Vasion Print versions prior to 22.0.1049 Vasion Print versions prior to 20.0.2786 Description Vasion Print formerly PrinterLogic Virtual Appliance Host and Application deployments expose PHP scripts located in the console release directory...