PT-2018-6785

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM versions prior to 7.0.0 Description: The issue affects Dolibarr ERP/CRM, where multiple SQL injection vulnerabilities have been identified. These vulnerabilities can be exploited via the "comm/propal/list.php" endpoint,...

CVE-2017-9839: Improper Neutralization of Special Elements used in an SQL Command

Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php type parameter...

CVE-2017-18259: Improper Neutralization of Input During Web Page Generation

Dolibarr ERP/CRM is affected by stored Cross-Site Scripting XSS in versions through 7.0.0...

CVE-2017-18260: Improper Neutralization of Special Elements used in an SQL Command

Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php viewstatut parameter or comm/propal/list.php propalstatut parameter, aka searchstatut parameter...

PT-2018-8542

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions prior to 5.0.4 Description The issue concerns SQL injection. It can be exploited via the "product/stats/card.php" API endpoint, specifically through the type parameter. Recommendations For versions prior to 5.0.4,...

PT-2018-8541

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions prior to 5.0.4 Description The issue concerns multiple reflected Cross-Site Scripting XSS vulnerabilities. The affected API endpoints and parameters include: "index.php" with the leftmenu parameter, "core/ajax/box.php...

PT-2018-6783

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM versions prior to 7.0.0 Description: The issue is related to stored Cross-Site Scripting XSS. Recommendations: For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue...

CVE-2017-9838: Improper Neutralization of Input During Web Page Generation

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...

Front Accounting ERP 2.4.3 Cross Site Request Forgery

!-- 2 This hosted page upon being clicked by an logged in admin user will lead to creation of a new...

Front Accounting ERP 2.4.3 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications input type="submit" va...

Front Accounting ERP 2.4.3 - Cross-Site Request Forgery

Front Accounting ERP 2.4.3 - Cross-Site Request Forgery...

Front Accounting ERP 2.4.3 - Cross-Site Request Forgery

!-- 2 This hosted page upo...

Authorization

SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2381

SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2381

CVE-2018-2381 affects SAP ERP Financials components (SAP_APPL 6.00–6.06, 6.16; SAP_FIN 6.17–7.30; S4CORE 1.00–1.02). The issue is insufficient authorization checks for an authenticated user, enabling escalation of privileges within the application. The description consistently states privilege el...

CVE-2018-2381

SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2381: Missing Authorization

SAP ERP Financials Information System SAPAPPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAPFIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

PT-2018-15513

Name of the Vulnerable Software and Affected Versions SAP ERP Financials Information System versions 6.00 through 6.06, 6.16 SAP ERP Financials Information System version 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE versions 1.00 through 1.02 Description The issue results from insufficient authorization...

Ciesto Solutions ERP System SQL Injection Vulnerability

Ciesto Solutions ERP System suffers from a remote SQL injection vulnerability that allows for authentication bypass. Exploit Title: Ciesto Solutions ERP System - Authentication Bypass Dork: N/A Date: 11.02.2018 Vendor Homepage: https://ciestosolutions.com/ Software Link:...

Ciesto Solutions ERP System SQL Injection

Exploit Title: Ciesto Solutions ERP System - Authentication Bypass Dork: N/A Date: 11.02.2018 Vendor Homepage: https://ciestosolutions.com/ Software Link: https://ciestosolutions.com/system-development/erp-solutions/ Version: N/A Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit...