CVE-2019-20520: Improper Neutralization of Input During Web Page Generation

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/method/ URI...

PT-2020-10496

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for reflected XSS via the PATH INFO to the "api/method/" URI. This means an attacker can inject malicious code into the system by manipulating the PATH INFO variable in requests to the...

CVE-2019-20519: Improper Neutralization of Input During Web Page Generation

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the user/ URI, as demonstrated by a crafted e-mail address...

PT-2020-10494

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for reflected XSS via the PATH INFO to the "project/" URI. This means an attacker can inject malicious code into the PATH INFO variable, potentially leading to the execution of unauthorized...

PT-2020-10490

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows reflected XSS via the PATH INFO to the address/ URI. This can be exploited by manipulating the PATH INFO variable in the request. Recommendations For ERPNext version 11.1.47, consider...

CVE-2019-20511

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

CVE-2019-20511

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

Design/Logic Flaw

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

CVE-2019-20511

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

CVE-2019-20511

CVE-2019-20511 affects ERPNext 11.1.47 and is described as a Frame Injection vulnerability via the blog?blog_category parameter. Red Hat/CNVD-style entries corroborate an injection issue stemming from insufficient input validation on user-supplied data; ERPNext’s styling of a blog category parame...

PT-2020-10487

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for frame injection via the blog category parameter. This can be exploited through the "blog?blog category=" endpoint. The blog category parameter is vulnerable to injection. Recommendations...

CVE-2019-20511: Improper Neutralization of Input During Web Page Generation

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

ERPNext 11.1.47 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Multiple Reflected Cross-site Scripting Vulnerabilities in ERPNext Affected Software: ERPNext Affected Versions: 11.1.47 Vendor Homepage: https://erpnext.com/ Vulnerability Type: Reflected Cross-site Scripting Severity: High Status:...

Frappe ERPNext SQL Injection Vulnerability (CNVD-2019-17163)

Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in Frappe ERPNext versio...

Sql injection

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

CVE-2018-20061 affects ERPNext 10.x and 11.x up to 11.0.3-beta.29. The issue is a SQL injection caused by calling a server-side Python function via JavaScript, enabling an attacker with a user account (no special privileges) to craft SQL queries and retrieve arbitrary columns from any tables. The...

CVE-2018-20061: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...