CVE-2021-44875

CVE-2021-44875 affects Dalmark Systems Systeam 2.22.8 build 1724. The issue is a user-enumeration flaw in the password-recovery flow: the application returns messages that differ depending on whether a user exists, enabling a brute-force attack to identify valid users. The vulnerability is docume...

CVE-2021-44877

CVE-2021-44877 affects Dalmark Systems Systeam 2.22.8 build 1724. A broken access control flaw allows an unauthenticated attacker to use an API endpoint to generate a temporary JWT token that references the correct tenant before authentication and to request system configuration parameters. This ...

Dalmark Systems Systeam 安全漏洞

Dalmark Systems Systeam is an Erp system from Dalmark Systems, a Brazilian company. version 2.22.8 build 1724 of Dalmark Systems Systeam contains a security vulnerability that could be exploited by an attacker to brute-force a valid user...

File upload vulnerability in concrete friend mixing plant ERP management system

Hunan AOKE Network Technology Co., Ltd. is a concrete enterprise informatization solution provider. The concrete friend mixing station ERP management system has an arbitrary file upload vulnerability, which can be exploited by an attacker to upload a webshell and gain server privileges...

SQL Injection Vulnerability in the ERP System of Chengdu Pan-Pro Software Development Co.

Chengdu Pan-Pro Software Development Co., Ltd, business scope contains material management system, construction cost management software, contract management system, project progress management system and so on. The ERP system of Chengdu Pan-Pro Software Development Co., Ltd. suffers from a SQL...

竣禾科技 ERP POS 跨站脚本漏洞

Junghwa Technology ERP POS System is an application software of China Junghwa Technology Co. System for ERP management. ERP POS suffers from a cross-site scripting vulnerability that originates from special characters on the news page not being filtered during user input, which allows remote...

SQL Injection Vulnerability in Tanaosoft Towel Textile ERP System

Jiangsu Hans Future Information Technology Co., Ltd, formerly known as "Huai'an Qixi Software Co., Ltd", was founded in 2009, is a technology-based enterprise mainly engaged in software development and sales. A SQL injection vulnerability exists in the Tanaosoft Towel Textile ERP system, which ca...

webERP local file inclusion vulnerability (CNVD-2021-13935)

webERP is a free and open source ERP system that provides best practice, multi-user business management and accounting tools over the web. A local file inclusion vulnerability exists in webERP 4.15. The vulnerability stems from the ManualContents.php file allowing users to specify the "Language"...

Exploit for Path Traversal in Totvs Fluig

Totvs Fluig Platform Fluig is the productivity and...

File Uploading Vulnerability in Eki Technologies ERP System

Ltd. is a software company focusing on enterprise management, specializing in providing professional information management consulting, software development and online mall development and other information services. A file upload vulnerability exists in the ERP system of EqiTech, which can be...

UFIDA NC suffers from SQL injection vulnerability (CNVD-2020-69451)

UFIDA NC is a large erp enterprise management system and e-commerce platform. UFIDA NC suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to obtain sensitive information from the database...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin) Exploit

Exploit for php platform in category web applications Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link:...

School ERP System 1.0 Cross Site Request Forgery

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate Tested on...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin)

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate CVE:...

Odoo Access Control Error Vulnerability (CNVD-2019-30601)

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language with PostgreSQL as database and includes modules for sales management, inventory management, financial management and so on. An access control...

SQL Injection and File Upload Vulnerabilities in Dimix ERP Office System of Shanghai Demisa Information Technology Co.

Shanghai Demisa Information Technology Co., Ltd. is a company that develops and sells intelligent office management software. A SQL injection and file upload vulnerability exists in the Dimix ERP office system of Shanghai Demisa Information Technology Co. An attacker can exploit the vulnerabiliti...

117.102.82.138 XSS vulnerability

Vulnerable URL: https://117.102.82.138/erp/login.php?goto=prompt/OPENBUGBOUNTY/...

Apache OFBiz嵌套表达式任意UEL执行漏洞

Bugtraq ID:61369 CVE ID:CVE-2013-2250 Apache OFBiz是一款开源的ERP系统 Apache OFBiz没有正确校验参数值，如果提供的参数包含JUEL元字符，可导致执行任意统一表达式语言UEL函数 0 Apache OFBiz 10.04.01 - 10.04.05 Apache OFBiz 11.04.01 - 11.04.02 Apache OFBiz 12.04.01 厂商解决方案 Apache OFBiz 10.04.06, 11.04.03或12.04.02已经修复此漏洞，建议用户下载更新： http://ofbiz.apache.o...

[Onapsis Security Advisory 2011-008] Oracle JD Edwards JDENET CallObjectKernel Remote Command Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory 2011-008: Oracle JD Edwards JDENET CallObjectKernel Remote Command Execution This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will...