CVE-2025-2706 Digiwin ERP UploadAjaxAPI.ashx unrestricted upload

A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has...

CVE-2025-2706

CVE-2025-2706 affects Digiwin ERP 5.0.1. The vulnerability resides in an unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx, where manipulation of the argument File leads to unrestricted upload. This allows a remote attacker to upload arbitrary files, with impact on confidentiality...

CVE-2025-2705

A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-2705 Digiwin ERP FileUploadApi.ashx DoWebUpload unrestricted upload

A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-2705 Digiwin ERP FileUploadApi.ashx DoWebUpload unrestricted upload

A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-2705

Summary: CVE-2025-2705 affects Digiwin ERP 5.1, specifically the DoUpload/DoWebUpload handler in /Api/FileUploadApi.ashx. The vulnerability arises from manipulation of the File argument, enabling unrestricted file uploads over a remote attack. The exploit has been disclosed publicly. Multiple con...

CVE-2024-8774 Privilege Escalation in SIMPLE.ERP

The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch [email protected], which removed the...

CVE-2024-8773 Protocol Downgrade in SIMPLE.ERP

SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version received a patch [email protected], which make ...

PT-2025-12679 · Yonyou · Yonyou Ufida Erp-Nc

Name of the Vulnerable Software and Affected Versions: Yonyou UFIDA ERP-NC version 5.0 Description: A vulnerability was found in Yonyou UFIDA ERP-NC, affecting an unknown functionality of the file /help/top.jsp. The manipulation of the langcode argument leads to cross site scripting. The attack c...

PT-2025-12703 · Yonyou · Yonyou Ufida Erp-Nc

Name of the Vulnerable Software and Affected Versions: Yonyou UFIDA ERP-NC version 5.0 Description: A problem was found in the processing of the file /menu.jsp. The manipulation of the argument flag leads to cross-site scripting. The attack may be initiated remotely. Recommendations: For Yonyou...

PT-2025-12704 · Yonyou · Yonyou Ufida Erp-Nc

Name of the Vulnerable Software and Affected Versions: Yonyou UFIDA ERP-NC version 5.0 Description: A problematic issue was found in the software, affecting an unknown function of the file /help/systop.jsp. The manipulation of the langcode argument leads to cross-site scripting. It is possible to...

Yonyou UFIDA ERP-NC 代码注入漏洞

Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...

webERP 代码注入漏洞

webERP is an open source inventory and financial management system ERP system by Tim Schofield, an individual developer. The system supports inventory management, rights role management, order management and financial management. A code injection vulnerability exists in webERP 5.0.0.rc+13 and pri...

PT-2025-12678 · Yonyou · Yonyou Ufida Erp-Nc

Name of the Vulnerable Software and Affected Versions: Yonyou UFIDA ERP-NC version 5.0 Description: A problematic issue has been identified, affecting the /login.jsp file. The manipulation of the key/redirect argument leads to cross-site scripting. This issue can be initiated remotely...

SIMPLE.ERP 安全漏洞

SIMPLE.ERP is an e-commerce platform from SIMPLE, Inc. A security vulnerability exists in SIMPLE.ERP versions 6.20 through 6.30, which stems from a superuser password stored in a recoverable format that allows any authenticated user to elevate privileges to the database administrator...

Digiwin ERP 代码问题漏洞

Digiwin ERP is an e-commerce platform from China Dingxin Digiwin. A code issue vulnerability exists in Digiwin ERP version 5.0.1, which originates from an unrestricted upload and could lead to a remote attack...

Digiwin ERP 代码问题漏洞

Digiwin ERP is an e-commerce platform from China Dingxin Digiwin. A code issue vulnerability exists in Digiwin ERP version 5.1, which originates from an unrestricted upload and could lead to a remote attack...

Yonyou UFIDA ERP-NC 代码注入漏洞

Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...

Yonyou UFIDA ERP-NC 代码注入漏洞

Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...

CVE-2025-2358

A vulnerability was found in Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Kfxt/Service.asmx of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For lead...