167 matches found
CVE-2025-46053
A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php...
CVE-2025-46052
An error-based SQL Injection SQLi vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php...
WebERP 安全漏洞
webERP is an open source inventory and financial management system ERP system by Tim Schofield, an individual developer. The system supports inventory management, permission role management, order management and financial management. A security vulnerability exists in WebERP v4.15.2, which...
webERP 安全漏洞
webERP is an open source inventory and financial management system ERP system by Tim Schofield, an individual developer. The system supports inventory management, permission role management, order management and financial management. A security vulnerability exists in webERP version v4.15.2, whic...
CVE-2025-46053
The open-source inventory and financial management system WebERP v4.15.2 is vulnerable to a SQL Injection vulnerability. Attackers can execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters during a POST request to...
CVE-2025-2715
A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...
CVE-2025-2715
A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...
CVE-2025-2715 timschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scripting
A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...
CVE-2025-2715 timschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scripting
A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...
CVE-2025-2715
A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...
CVE-2025-2715
The CVE-2025-2715 entry describes a cross-site scripting flaw affecting timschofield webERP up to 5.0.0.rc+13, in ConfirmDispatch_Invoice.php (Narrative parameter). Remote exploitation is possible; multiple sources note the vulnerability and advise applying a patch. The initial disclosure indicat...
webERP 代码注入漏洞
webERP is an open source inventory and financial management system ERP system by Tim Schofield, an individual developer. The system supports inventory management, rights role management, order management and financial management. A code injection vulnerability exists in webERP 5.0.0.rc+13 and pri...
PT-2025-12681
Name of the Vulnerable Software and Affected Versions timschofield webERP versions up to 5.0.0.rc+13 Description A problematic vulnerability has been found in timschofield webERP, affecting an unknown part of the file ConfirmDispatch Invoice.php of the component Confirm Dispatch and Invoice Page...
CVE-2025-2715: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...
webERP local file inclusion vulnerability (CNVD-2021-13935)
webERP is a free and open source ERP system that provides best practice, multi-user business management and accounting tools over the web. A local file inclusion vulnerability exists in webERP 4.15. The vulnerability stems from the ManualContents.php file allowing users to specify the "Language"...
CVE-2020-22474
In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion...
CVE-2020-22474
In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion...
Design/Logic Flaw
In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion...
CVE-2020-22474
The CVE-2020-22474 issue affects webERP 4.15, where ManualContents.php mishandles the Language parameter, enabling local file inclusion (LFI). Affected component: ManualContents.php in webERP 4.15. Root cause: improper handling/validation of a user-supplied Language value that can cause local fil...