ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext 15.89.0 and earlier versions, which stems from improper handling of the frompostingdate parameter in the getoutstandingreferencedocuments function, which could lead to an...

CVE-2025-66439

An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments at erpnext.accounts.doctype.paymententry.paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the...

CVE-2025-66440

An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments at erpnext/accounts/doctype/paymententry/paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the...

CVE-2025-66439

An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments at erpnext.accounts.doctype.paymententry.paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the...

CVE-2025-66439

Frappe ERPNext versions through 15.89.0 are vulnerable to an SQL Injection flaw in the get_outstanding_reference_documents() function located at erpnext.accounts.doctype.payment_entry.payment_entry.py. The root cause is the direct interpolation of the from_posting_date parameter into a database q...

CVE-2025-66439

An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments at erpnext.accounts.doctype.paymententry.paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the...

CVE-2025-67899

uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas...

EUVD-2025-203281

Exim before 4.99.1 allows remote heap corruption that will be further described on 2025-12-18...

CVE-2025-67896

Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation...

CVE-2025-36754

creationtimestamp| type| source ---|---|--- 2025-12-13 11:39:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7ujdmvbtx2q 2025-12-14 01:34:15+00:00| seen| https://infosec.exchange/users/offseq/statuses/115715345801833765...

CVE-2025-36752

creationtimestamp| type| source ---|---|--- 2025-12-13 11:28:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7uiptuzgj2c 2025-12-14 00:04:03+00:00| seen| https://infosec.exchange/users/offseq/statuses/115714991181828880...

CVE-2025-66402

creationtimestamp| type| source ---|---|--- 2025-12-13 10:32:46+00:00| published-proof-of-concept| https://github.com/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3 2026-01-06 20:11:53+00:00| published-proof-of-concept| Telegram/mJFISOaG9sdliiq532xrtHTh4hR6RCcMc304VWQpxZ4gXns...

CVE-2025-36747

creationtimestamp| type| source ---|---|--- 2025-12-13 09:35:18+00:00| seen| https://infosec.exchange/users/offseq/statuses/115711575109311329 2025-12-13 09:35:20+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m7ucgdm4j22a 2025-12-13 11:49:38+00:00| seen|...

CVE-2025-11693

creationtimestamp| type| source ---|---|--- 2025-12-13 05:34:11+00:00| seen| https://infosec.exchange/users/offseq/statuses/115710627021545993 2025-12-13 05:34:13+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m7tux73etr2k 2025-12-13 11:20:29+00:00| seen|...

CVE-2025-14585

creationtimestamp| type| source ---|---|--- 2025-12-13 03:30:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7to2ll7oh2g...

CVE-2025-64539

creationtimestamp| type| source ---|---|--- 2025-12-13 01:39:30+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3m7thtjiqrs2f...

CVE-2025-67750

creationtimestamp| type| source ---|---|--- 2025-12-13 00:02:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7tcfevafa2y...

CVE-2025-46285

creationtimestamp| type| source ---|---|--- 2025-12-12 23:47:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7tbkjj2jn22 2025-12-16 06:48:31+00:00| seen| https://vulnerability.circl.lu/bundle/c5b7cfe4-31dc-48ad-9aad-8e8bd3c6bf83 2026-04-02 22:21:28+00:00| seen|...

CVE-2025-64580

creationtimestamp| type| source ---|---|--- 2025-12-12 23:17:20+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3m7t7vc6v6m2i...

Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting XSS https://owasp.org/www-community/attacks/xss attack. The vulnerability occurs because the 'title-date-format'...