Exposición de ERPNext

CMS
131
score de exposición
356
sitios usan
0
en explotación
4
críticos

CVEs

100 resultados
CVE-2020-6145MEDIUMAn SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request cEPSS 1.8%CVE-2026-65974CRITICALERPNext: Server-Side Template Injection leading to Remote Code ExecutionEPSS 1.0%CVE-2018-3885MEDIUMAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQLEPSS 0.9%CVE-2018-3884MEDIUMAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQLEPSS 0.9%CVE-2018-3883MEDIUMAn exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQLEPSS 0.9%CVE-2022-23056—ERPNext - Stored XSS leads to account takoverEPSS 0.9%CVE-2026-72911CRITICALERPNext: Possibility of server-side template injection due to missing validationEPSS 0.7%CVE-2026-72908MEDIUMERPNext: Possibility of SQL injection due to missing validationEPSS 0.5%CVE-2026-72910HIGHERPNext: Unauthorised modification of master data due to missing validationEPSS 0.5%CVE-2026-72909HIGHERPNext: Broken Access Control on certain endpointsEPSS 0.5%CVE-2026-65822HIGHERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filterEPSS 0.5%CVE-2026-72907MEDIUMERPNext: Broken Access Control on certain endpointEPSS 0.4%CVE-2026-94113HIGHFrappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet EndpointsEPSS 0.4%CVE-2026-96672MEDIUMFrappe ERPNext before 16.34.1 Unauthorized Method InvocationEPSS 0.4%CVE-2026-27471CRITICALERP: Document access through endpoints due to missing validationEPSS 0.4%CVE-2026-12895HIGHSQL Injection in Frappe's ERPNextEPSS 0.4%CVE-2026-44440MEDIUMERPNext: Path Traversal Leading to Sensitive File ExposureEPSS 0.4%CVE-2026-72906MEDIUMERPNext: Unauthorised triggering of automated emails due to missing validationEPSS 0.4%CVE-2025-58439HIGHERP: Possibility of SQL injection due to missing validationEPSS 0.3%CVE-2026-109663HIGHFrappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint ParametersEPSS 0.3%