CVE-2019-20518: Improper Neutralization of Input During Web Page Generation

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the project/ URI...

CVE-2019-20517: Improper Neutralization of Input During Web Page Generation

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the contact/ URI...

PT-2020-10491

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for reflected XSS via the PATH INFO to the "addresses/" URI. This means an attacker can craft a malicious URL that, when visited by a user, can execute arbitrary JavaScript code on the user'...

PT-2020-10495

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for reflected XSS via the PATH INFO to the "user/" URI. This can be demonstrated by a crafted e-mail address. Recommendations For ERPNext version 11.1.47, update to a newer version that...

CVE-2019-20511

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

CVE-2019-20511

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

Design/Logic Flaw

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

CVE-2019-20511

CVE-2019-20511 affects ERPNext 11.1.47 and is described as a Frame Injection vulnerability via the blog?blog_category parameter. Red Hat/CNVD-style entries corroborate an injection issue stemming from insufficient input validation on user-supplied data; ERPNext’s styling of a blog category parame...

CVE-2019-20511

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

PT-2020-10487

Name of the Vulnerable Software and Affected Versions ERPNext version 11.1.47 Description The issue allows for frame injection via the blog category parameter. This can be exploited through the "blog?blog category=" endpoint. The blog category parameter is vulnerable to injection. Recommendations...

CVE-2019-20511: Improper Neutralization of Input During Web Page Generation

ERPNext 11.1.47 allows blog?blogcategory= Frame Injection...

ERPNext 11.1.47 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Multiple Reflected Cross-site Scripting Vulnerabilities in ERPNext Affected Software: ERPNext Affected Versions: 11.1.47 Vendor Homepage: https://erpnext.com/ Vulnerability Type: Reflected Cross-site Scripting Severity: High Status:...

Frappe ERPNext SQL Injection Vulnerability (CNVD-2019-17163)

Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in Frappe ERPNext versio...

Sql injection

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...

CVE-2018-20061

CVE-2018-20061 affects ERPNext 10.x and 11.x up to 11.0.3-beta.29. The issue is a SQL injection caused by calling a server-side Python function via JavaScript, enabling an attacker with a user account (no special privileges) to craft SQL queries and retrieve arbitrary columns from any tables. The...

PT-2018-15246

Name of the Vulnerable Software and Affected Versions ERPNext versions 10.x through 11.0.3-beta.29 Description A SQL injection issue was discovered that allows an attacker to construct SQL queries to return any columns from any tables in the database. This issue is related to the...

CVE-2018-20061: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that...