Odoo <= 8.0-20160726 & 9.0 - Open Redirect

An Open Redirect vulnerability in Odoo versions = 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL. id: CVE-2017-5871 info: name: Odoo = 8.0-20160726 & 9.0 - Open Redirect author: 1337rokudenashi severity: medium description: | An Open...

Odoo Apps - Cross-Site Scripting via Prototype Pollution

jquery-bbq 1.2.1 contains a prototype pollution caused by improperly controlled modification of object prototype attributes, letting malicious users inject properties into Object.prototype, exploit requires malicious user interaction. id: CVE-2021-20086 info: name: Odoo Apps - Cross-Site Scriptin...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

Odoo 8.0/9.0/10.0 - Local File Inclusion

Odoo 8.0, 9.0, and 10.0 are susceptible to local file inclusion via tools.fileopen. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-9416 info: name: Odoo 8.0/9.0/10.0 -...

CVE-2019-14322

CVE-2019-14322 Modification of faisalfs10x exploit: PoC of CVE-2019-14322: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' https://www.acunetix.com/vulnerabilities/web/odoo-lfi-cve-2019-14322/ https://nvd.nist.gov/vuln/detail/CVE-2019-14322 Description A vulnerability...

Odoo_PDFjs_CVE-2024-4367.pdf

This repository does not have a README...

pdfjs_disable_eval

pdfjsdisableeval Module for disabling JavaScript evaluation in PDF.js. This works around the missing fix in Odoo 14.0 for CVE-2024-4367...

CVE-2026-108861

A flaw was found in odoo-mcp. This vulnerability allows authenticated users or prompt-injected agents to bypass field-level access control lists ACLs by invoking the executemethod tool. By executing data retrieval operations against restricted fields, an attacker can access unredacted data, leadi...

CVE-2026-108861

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

EUVD-2026-97012

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-108861

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-108861

Odoo MCP versions 1.0.0 through 1.3.2 are vulnerable to an information disclosure flaw within the execute_method tool . This vulnerability allows MCP clients or prompt-injected agents to bypass field-level Access Control Lists (ACL) . By invoking the execute_method tool and naming fields that sho...

CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-108861: Exposure of Sensitive Information to an Unauthorized Actor

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

PT-2026-110180

Name of the Vulnerable Software and Affected Versions Odoo MCP versions 1.0.0 through 1.3.2 Description An information disclosure issue exists where MCP clients can bypass field-level Access Control Lists ACL by using the execute method tool. This allows attackers or prompt-injected agents to cal...

Odoo - Database Manager Discovery Detection

Odoo database manager was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Odoo database manager was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Odoo - Database Manager Discovery Detection',...

Odoo 8.0/9.0/10.0 - Local File Inclusion Detection

Odoo 8.0, 9.0, and 10.0 are susceptible to local file inclusion via tools.fileopen. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Odoo...

Odoo - Panel Detect

Detects Odoo - Panel Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Odoo - Panel Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Odoo - Panel Detect', 'description': 'Detects Odoo - Panel...