27640 matches found
CVE-2025-61733
creationtimestamp| type| source ---|---|--- 2025-09-30 16:17:35+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m22wfji3ld23 2025-10-02 12:36:27+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115304601143297105 2025-10-06 13:48:27+00:00| seen|...
CVE-2025-52050
In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...
CVE-2024-13150
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection.This issue affects fayton.Pro ERP: through 20250929...
CVE-2025-41095
creationtimestamp| type| source ---|---|--- 2025-09-30 11:57:25+00:00| seen| Telegram/IByZ3gpMuCVXQmWNcnNVrQKVD-Vfj4Bk0YGBnSQIjdPTA...
CVE-2025-7063
creationtimestamp| type| source ---|---|--- 2025-09-30 11:00:34+00:00| seen| Telegram/IAdbnHTJCfUUBph1zMCi4hRMAorF36HEK9DqS8CeaOIOuAI 2025-09-30 11:00:35+00:00| seen| Telegram/ctVXQJnmhN5CCA-5ZoC6w5XxXgpdy4w1DFd74cFdBVCMNs 2025-09-30 11:00:36+00:00| seen|...
CVE-2025-0016
creationtimestamp| type| source ---|---|--- 2025-09-30 08:28:35+00:00| seen| https://gist.github.com/Darkcrai86/c13969010103b69e0105cf1f0b7454db...
CVE-2025-10191
creationtimestamp| type| source ---|---|--- 2025-09-30 03:58:47+00:00| seen| Telegram/llPKRqSCKnA4WaL4oF-SkHBZh3Do9rJXC1vVbTWYJjrAbP8...
CVE-2025-57529
creationtimestamp| type| source ---|---|--- 2025-09-30 02:57:56+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/53602 2025-10-18 09:50:45+00:00| seen| https://t.me/NinjaSec/424 2026-02-04 16:57:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2duahplb2r...
PT-2025-39992
Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The get loyalty program details with points function located at erpnext/accounts/doctype/loyalty program/loyalty program.py is susceptible to SQL Injection. An attacker can inject a SQL query into the...
CVE-2025-52050
In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...
CVE-2025-52050
In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...
CVE-2025-52050
CVE-2025-52050 affects Frappe ERPNext 15.57.5. The vulnerability is in function get_loyalty_program_details_with_points() (loyalty_program.py) and is caused by SQL injection via the expiry_date parameter, allowing an attacker to extract all information from databases. The connected documents prov...
Frappe Technologies Frappe 安全漏洞
Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe version 15.57.5, which stems from insufficient validation of the expirydate parameter and...
CVE-2025-52050
In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...
CVE-2025-35032
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08...
CVE-2025-35030
Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08...
CVE-2025-35031
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08...
CVE-2025-35034
Medical Informatics Engineering Enterprise Health is affected by a reflected cross-site scripting vulnerability in the portlet_user_id URL parameter. A remote, unauthenticated attacker can craft a URL to execute arbitrary JavaScript in a victim’s browser. The issue is fixed as of 2025-03-14. Acco...
CVE-2025-35031
Medical Informatics Engineering Enterprise Health is affected by CVE-2025-35031, where the software includes the user’s current session token in debug output. This enables an attacker to impersonate the user if the token is exfiltrated (e.g., via the user sending debug output). The issue is fixed...