CVE-2021-3693

LedgerSMB vulnerabilities (CVE-2021-3693 among others) arise from LedgerSMB not checking the origin of HTML fragments, enabling an authenticated user to receive a specially crafted URL that could lead to remote code execution or information disclosure. Public docs cover multiple advisories across...

CVE-2021-3731

CVE-2021-3731 affects LedgerSMB with clickjacking risk where an attacker could trick a user into performing unintended actions via wrapping. Connected advisories corroborate cross-site scripting/clickjacking exposure and related input handling weaknesses across multiple distros (Debian, Ubuntu); ...

CVE-2021-3882

LedgerSMB CVE-2021-3882 concerns the Secure attribute on the session authorization cookie. The vulnerability arises when LedgerSMB servers behind a reverse proxy respond to unencrypted HTTP; an attacker who can observe traffic and trick a user into using HTTP could obtain the authentication cooki...

CVE-2021-3694

LedgerSMB has a vulnerability where error messages were not sufficiently HTML-encoded, allowing an authenticated user to exploit a specially crafted URL to trigger remote code execution and information disclosure. The issue is documented across multiple advisories (CVE-2021-3694 and related CVEs)...

CVE-2006-4731

CVE-2006-4731 is a directory traversal vulnerability in SQL-Ledger (before 2.6.19) and LedgerSMB (before 1.0.0p1). Remote attackers could cause arbitrary Perl code execution by supplying a terminal parameter value containing ../, as reported across multiple advisories. Related OpenVAS entries con...

CVE-2007-1923

LedgerSMB and DWS Systems SQL-Ledger are affected by CVE-2007-1923 due to access-control weaknesses that let remote attackers access restricted functionality by directly requesting URLs. Affected LedgerSMB versions are prior to 1.3.0; PT-2007-3268 recommends upgrading LedgerSMB to 1.3.0 or later....

CVE-2007-1436

CVE-2007-1436 affects LedgerSMB/SQL-Ledger and concerns an authentication bypass in the admin.pl entry point. The vulnerability allows remote attackers to bypass the password check and gain administrative access via unknown vectors. Affected software is LedgerSMB or SQL-Ledger prior to versions 1...

CVE-2007-1329

CVE-2007-1329 affects SQL-Ledger, and LedgerSMB before 1.1.5. A directory traversal flaw allows remote attackers to read/overwrite arbitrary files and execute arbitrary code by using "." characters adjacent to (1) users and (2) users/members; blacklist filtering collapses to ".." sequences. The v...

CVE-2008-4077

LedgerSMB pre-1.2.15 and SQL-Ledger 2.8.17 and earlier are affected by CVE-2008-4077. The issue arises in the CGI scripts, where an HTTP POST with a large Content-Length can cause resource exhaustion (DoS). The vulnerability is exploited remotely via crafted requests to the CGI endpoints. Remedia...

CVE-2007-0667

The CVE-2007-0667 entry: The redirect function in Form.pm affects LedgerSMB

CVE-2007-1437

CVE-2007-1437 affects LedgerSMB prior to 1.1.5 and SQL-Ledger prior to 2.6.25. The vulnerability allows remote attackers to overwrite files and possibly bypass authentication, and remote authenticated users to execute unauthorized code by calling a custom error function that returns from executio...

CVE-2007-1540

CVE-2007-1540: Directory traversal in am.pl affects SQL-Ledger 2.6.27 and earlier and LedgerSMB before 1.2.0. The login parameter can be manipulated with a .. sequence and trailing NULL (%00) to run arbitrary executables and bypass authentication. The issue was reportedly addressed in SQL-Ledger ...

CVE-2007-5372

The CVE-2007-5372 entry documents multiple SQL injection vulnerabilities in LedgerSMB (1.0.0–1.2.7) and DWS Systems SQL-Ledger (2.x), allowing remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field. Affected components and exact root cause are ...

CVE-2008-4078

SQL injection in the AR/AP transaction report affects LedgerSMB < 1.2.15 and SQL-Ledger

CVE-2024-23831

LedgerSMB vulnerability CVE-2024-23831 allows privilege escalation by tricking a database administrator in an active /setup.pl session into submitting a request that creates a new admin user via /login.pl. This is rooted in insufficient verification when HTML fragments are processed during setup,...

CVE-2006-5589

Summary: CVE-2006-5589 affects LedgerSMB (LSMB) up to 1.1.0 and earlier with SQL injection vulnerabilities in the modules OE.pm, AM.pm, and Form.pm that allow remote execution of arbitrary SQL commands. The risk is described as high (CVSS v2 base score 7.5). Connected documents confirm that Ledge...

CVE-2018-9246

The CVE-2018-9246 issue affects the PGObject::Util::DBAdmin Perl module prior to 0.120.0, used in LedgerSMB up to 1.5.x. It inadequately sanitizes/escapes variables used in shell commands, enabling shell code injection via create(), run_file(), backup(), or restore(). This allows an attacker to e...

CVE-2007-3907

CVE-2007-3907 affects LedgerSMB 1.2.0–1.2.6. An authentication bypass allows remote attackers to perform actions as an arbitrary user via a crafted URL using a redirect parameter and a callback parameter containing an escaped URL. The exact vectors are not detailed in the provided documents. No p...