Exposição de ERPNext

CMS
131
score de exposição
356
sites usam
0
em exploração
4
críticos
Análise Vexday

O histórico de vulnerabilidades do ERPNext reúne 17 CVEs catalogadas, com 2 classificadas como críticas e nenhuma registrada no catálogo CISA KEV, situando a plataforma abaixo da média geral de exploração ativa do catálogo. O dado que merece atenção imediata é a concentração de 9 vulnerabilidades surgidas nos últimos 90 dias, sinalizando aumento recente na superfície de risco. O tipo de falha predominante é CWE-89 (SQL Injection), padrão que historicamente favorece acesso não autorizado a dados e comprometimento de banco de dados, sendo representado pela CVE-2020-6145, apontada como a mais perigosa atualmente ativa, com EPSS de 0,018. Embora as probabilidades de exploração observadas sejam baixas no momento, a combinação de falhas de injeção SQL e o volume elevado de CVEs recentes recomenda atenção prioritária em processos de atualização e revisão de controles de acesso ao banco de dados.

CVEs

100 resultados
CVE-2026-44446HIGHERPNext: Possibility of SQL Injection due to missing validationEPSS 0.3%CVE-2026-42839MEDIUMERPNext 16.16.0 - Stored XSS in POS cart item renderingEPSS 0.3%CVE-2026-109661HIGHFrappe ERPNext before 15.116.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109614HIGHFrappe ERPNext before 16.34.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109624HIGHFrappe ERPNext before 15.120.0 Missing Authorization Exposes Personal DataEPSS 0.3%CVE-2026-109625HIGHFrappe ERPNext before 15.121.3 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109627HIGHFrappe ERPNext before 15.120.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109632HIGHFrappe ERPNext before 15.121.0 Missing Authorization on Certain EndpointsEPSS 0.3%CVE-2026-109636HIGHFrappe ERPNext before 15.115.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109643HIGHFrappe ERPNext before 15.111.0 Missing Authorization Exposes Project DataEPSS 0.3%CVE-2026-109644HIGHFrappe ERPNext before 15.119.0 Unauthorized Access to Valuation DataEPSS 0.3%CVE-2026-109650HIGHFrappe ERPNext before 15.112.0 Missing Authorization Exposes Personal DataEPSS 0.3%CVE-2026-109656HIGHFrappe ERPNext before 15.118.2 Unauthorized Item Master Data AccessEPSS 0.3%CVE-2026-109658HIGHFrappe ERPNext before 15.115.0 Missing Authorization on EndpointsEPSS 0.3%CVE-2026-109659HIGHFrappe ERPNext before 15.113.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109672HIGHFrappe ERPNext before 15.118.0 Missing Authorization Exposes Financial DataEPSS 0.3%CVE-2026-109608HIGHFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint InputEPSS 0.3%CVE-2026-109377MEDIUMERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup MethodsEPSS 0.3%CVE-2026-109376MEDIUMERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_htmlEPSS 0.3%CVE-2026-109645HIGHFrappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing AuthorizationEPSS 0.2%