ERPNext 跨站脚本漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext versions v12.0.9 through v13.0.3, which stems from a user input that is not properly validated, and can be exploited by an attacker to inject arbitrary code...

ERPNext 跨站脚本漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext versions v12.0.9-v13.0.3, which originates from allowing a low-privileged user to store a malicious script in the "username" field of "my settings", which cou...

ERPNext 跨站脚本漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext versions v13.0.0-beta.13 through v13.30.0, which can be exploited by an attacker to conduct an account takeover attack with a low-privileged user...

ERPNext 12.18.0 / 13.0.0 SQL Injection Vulnerability

Authenticated SQL injection in ERPNext 13.0.0/12.18.0 Overview Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2103-01 Affected product: ERPNext Tested versions: 12.18.0 and 13.0.0 beta Vendor: Frappé Technologies https://frappe.io Credits: Trovent...

ERPNext 12.18.0 / 13.0.0 Cross Site Scripting Vulnerability

Multiple XSS vulnerabilities in ERPNext 13.0.0/12.18.0 Overview Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2103-02 Affected product: ERPNext Tested versions: 12.18.0 and 13.0.0 beta Vendor: Frappé Technologies https://frappe.io Credits: Troven...

ERPNext 12.18.0 / 13.0.0 Cross Site Scripting

Trovent Security Advisory 2103-02 Multiple XSS vulnerabilities in ERPNext 13.0.0/12.18.0 Overview Advisory ID: TRSA-2103-02 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2103-02 Affected product: ERPNext Tested versions: 12.18.0 and 13.0.0 beta...

ERPNext 12.18.0 / 13.0.0 SQL Injection

Trovent Security Advisory 2103-01 Authenticated SQL injection in ERPNext 13.0.0/12.18.0 Overview Advisory ID: TRSA-2103-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2103-01 Affected product: ERPNext Tested versions: 12.18.0 and 13.0.0 beta...

ERPNext 12.14.0 - SQL Injection (Authenticated)

Exploit Title: ERPNext 12.14.0 - SQL Injection Authenticated Date: 21-01-21 Exploit Author: Hodorsec Vendor Homepage: http://erpnext.org Software Link: https://erpnext.org/download Version: 12.14.0 Tested on: Ubuntu 18.04 !/usr/bin/python3 AUTHENTICATED SQL INJECTION VULNERABILITY In short: Found...

ERPNext frappe.desk.reportview.get SQL injection vulnerability

Talos Vulnerability Report TALOS-2020-1091 ERPNext frappe.desk.reportview.get SQL injection vulnerability August 18, 2020 CVE Number CVE-2020-6145 SUMMARY An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can...

CVE-2020-6145

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-6145

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Sql injection

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-6145

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-6145

CVE-2020-6145 affects ERPNext 11.1.38 via the function frappe.desk.reportview.get . The vulnerability is an SQL injection caused by unsafely handling inputs in the request (e.g., POST data) that flows into database queries, potentially enabling an attacker with authenticated access to manipulate ...

ERPNext SQL Injection Vulnerability (CNVD-2020-44886)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A SQL injection vulnerability exists in the 'frappe.desk.reportview.get' function in ERPNext version 11.1.38. The vulnerability stems from a lack of validation of externally entered SQL statements in database-base...

ERPNext cross-site scripting vulnerability (CNVD-2020-19004)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

ERPNext Cross-Site Scripting Vulnerability

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

ERPNext cross-site scripting vulnerability (CNVD-2020-19002)

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabilit...

ERPNext Cross-Site Scripting Vulnerability (CNVD-2020-25805)

ERPNext is a free, open source, integrated enterprise resource planning software. A cross-site scripting vulnerability exists in ERPNext version 11.1.47. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability ...

ERPNext Reflective Cross-Site Scripting Vulnerability (CNVD-2020-18553)

ERPNext is a free, open source, integrated enterprise resource planning software. A reflected cross-site scripting vulnerability exists in ERPNext 11.1.47. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the PATHINFO of the addresses/ URI...