20 matches found
EUVD-2025-17795
Malicious code in bioql PyPI...
EUVD-2024-54663
Malicious code in bioql PyPI...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
Erxes Path Traversal vulnerability
In Erxes 1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler...
GHSA-7RHV-XM4Q-WH42 Erxes Incorrect Access Control vulnerability
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
Erxes Path Traversal vulnerability
In Erxes 1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
CVE-2024-57186
In Erxes 1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler...
CVE-2024-57189
In Erxes versions prior to 1.6.2 , an authenticated attacker can write to arbitrary files on the system due to a Path Traversal vulnerability. The root cause is improper input validation and insufficient sanitization of file paths within the importHistoriesCreate GraphQL mutation handler. To reme...
Erxes security vulnerabilities
erxes is an open source Hubspot/Qualtrics alternative to erxes open source. Enabling SaaS providers and digital marketing agencies/developers to create unique experiences for their entire business. A security vulnerability exists in erxes versions prior to 1.6.2, which stems from a path traversal...
CVE-2024-57190
Erxes versions prior to 1.6.1 are vulnerable to an Incorrect Access Control flaw. The root cause is the improper validation of the "User" HTTP header , which allows an attacker to bypass authentication by providing a header containing any arbitrary user. This bypass enables unauthorized access to...
CVE-2024-57186
In Erxes 1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
CVE-2024-57186
In Erxes versions prior to 1.6.2 , a Path Traversal vulnerability exists in the /read-file endpoint handler. This flaw allows an unauthenticated attacker to read arbitrary files from the system due to improper validation of pathnames. To resolve this issue, users are recommended to update to vers...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
Erxes security vulnerabilities
erxes is an open source Hubspot/Qualtrics alternative to erxes open source. Enabling SaaS providers and digital marketing agencies/developers to create unique experiences for their entire business. A security vulnerability exists in versions prior to erxes 1.6.1 that stems from improper access...
CVE-2024-57189
In Erxes 1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler...
CVE-2021-32853
Erxes, an experience operating system XOS with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches...
CVE-2021-32853 Erxes vulnerable to Cross-site Scripting
Erxes, an experience operating system XOS with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches...