CVE-2025-65878

The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint /file/showImageByPath does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to th...

CVE-2025-65879

CVE-2025-65879 — Normal mode Warehouse Management System 1.2 is affected by an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server’s UPLOAD_PATH and passed to File.delete(...

CVE-2025-65878

CVE-2025-65878 affects Warehouse Management System v1.2. The vulnerability is an arbitrary file read via /file/showImageByPath where unsanitized user-supplied path parameters enable directory traversal to read arbitrary server files, risking leakage of sensitive information. Documented in multipl...

CVE-2025-65878

The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint /file/showImageByPath does not sanitize user-controlled path parameters. An attacker could exploit directory traversal to read arbitrary files on the server's file system. This could lead to th...

PT-2025-49264

Name of the Vulnerable Software and Affected Versions warehouse management system version 1.2 Description The software has an arbitrary file read issue. The /file/showImageByPath API endpoint does not properly sanitize user-supplied path parameters, potentially allowing an attacker to use directo...

CVE-2025-11962

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS.This issue affects Digital Corporate Warehouse: before v.4.8.2.22...

CVE-2025-11962

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS. This issue affects Digital Corporate Warehouse: before v.4.8.2.22...

EUVD-2025-124978

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS.This issue affects Digital Corporate Warehouse: before v.4.8.2.22...

CVE-2025-11962

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS. This issue affects Digital Corporate Warehouse: before v.4.8.2.22...

CVE-2025-11962

CVE-2025-11962 is a Stored XSS in DivvyDrive Information Technologies’ Digital Corporate Warehouse (pre-4.8.2.22). The issue arises from improper input neutralization during web page generation, enabling stored cross-site scripting. Affected software: Digital Corporate Warehouse versions before 4...

CVE-2025-11962 Stored XSS in DivvyDrive Information Technologies' Digital Corporate Warehouse

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS. This issue affects Digital Corporate Warehouse: before v.4.8.2.22...

CVE-2025-11962 Stored XSS in DivvyDrive Information Technologies' Digital Corporate Warehouse

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS. This issue affects Digital Corporate Warehouse: before v.4.8.2.22...

DivvyDrive Digital Corporate Warehouse 跨站脚本漏洞

DivvyDrive Digital Corporate Warehouse is a file management platform from the Turkish company DivvyDrive. A cross-site scripting vulnerability exists in versions prior to DivvyDrive Digital Corporate Warehouse v.4.8.2.22, which stems from improper input neutralization during web page generation a...

PT-2025-46581

Name of the Vulnerable Software and Affected Versions DivvyDrive Information Technologies Inc. Digital Corporate Warehouse versions prior to 4.8.2.22 Description The software contains an Improper Neutralization of Input During Web Page Generation issue, specifically a Stored Cross-site Scripting...

CVE-2025-9339

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6...

EUVD-2025-35175

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user to send a payload of up to 20 characters. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate da...

CVE-2025-9339

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6...

CVE-2025-9339

SIMPLE.ERP CVE-2025-9339 is a SQL injection in the Warehouse Document Filter form fields, affecting versions before [email protected]. The vulnerability allows a logged-in user to inject queries with up to 20 characters; a confirmed use case could delete tables whose names are at most 6 characters long....

CVE-2025-9339 SQL Injection in SIMPLE.ERP

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6...

CVE-2025-9339 SQL Injection in SIMPLE.ERP

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6...