CVE-2025-11140

A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed...

CVE-2025-11140

A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed...

CVE-2025-11139

A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has...

CVE-2025-11139 Bjskzy Zhiyou ERP com.artery.form.services.FormStudioUpdater uploadStudioFile path traversal

A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has...

CVE-2025-11139 Bjskzy Zhiyou ERP com.artery.form.services.FormStudioUpdater uploadStudioFile path traversal

A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has...

Bjskzy Zhiyou ERP 代码问题漏洞

Bjskzy Zhiyou ERP is an Enterprise Resource Planning software from Bjskzy Beijing, China. A code issue vulnerability exists in Bjskzy Zhiyou ERP version 11.0 and prior versions, which stems from the incorrect manipulation of the parameter contentString of the function openForm in the component...

PT-2025-39807

Name of the Vulnerable Software and Affected Versions Bjskzy Zhiyou ERP versions prior to 11.0 Description A path traversal issue exists in Bjskzy Zhiyou ERP. The uploadStudioFile function within the com.artery.form.services.FormStudioUpdater component is affected. Manipulation of the filepath...

CVE-2024-12796

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS. This issue affects Workcube ERP: from V12 - V14 before Cognitive...

CVE-2024-12796 Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS.This issue affects Workcube ERP: from V12 - V14 before Cognitive...

CVE-2024-12796 Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS. This issue affects Workcube ERP: from V12 - V14 before Cognitive...

PT-2025-37982

Name of the Vulnerable Software and Affected Versions: Workcube ERP versions V12 through V14 through 20250916 Description: Workcube ERP is susceptible to a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Workcube ERP...

Linux Distros Unpatched Vulnerability : CVE-2019-19211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS. CVE-2019-19211 Note that Nessus relies on the presence of...

Linux Distros Unpatched Vulnerability : CVE-2017-7886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. CVE-2017-7886 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2018-19799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS. CVE-2018-19799 Note that Nessus relies on the presence of the package as reported by t...

Linux Distros Unpatched Vulnerability : CVE-2021-33618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by and and characters in the onpointermove attribute of a BODY element to the...

Linux Distros Unpatched Vulnerability : CVE-2018-13450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statusbatch...

Linux Distros Unpatched Vulnerability : CVE-2017-7888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier. CVE-2017-7888 Note that Nessus relies on the presence of...

Linux Distros Unpatched Vulnerability : CVE-2024-40137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution RCE vulnerability via the Computed field parameter under the Users Modul...

Linux Distros Unpatched Vulnerability : CVE-2023-4198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Access Control in Dolibarr ERP CRM = v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data CVE-2023-4198...

Linux Distros Unpatched Vulnerability : CVE-2017-17899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via t...