Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

42 results

Oct 16, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-108374 · Other software · frappe · reported by GitHubHigh 7.7
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-108373 · Other software · frappe · reported by GitHubMedium 6.5
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 17, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-65974 · Other software · frappe · reported by GitHubCritical 9.9
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 17, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-65822 · Other software · frappe · reported by GitHubHigh 7.6
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-72911 · Other software · frappe · reported by GitHubCritical 9.9
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-72910 · Other software · frappe · reported by GitHubHigh 7.1
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-72909 · Other software · frappe · reported by GitHubHigh 7.1
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-72908 · Other software · frappe · reported by GitHubMedium 6.5
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-72907 · Other software · frappe · reported by GitHubMedium 6.5
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-72906 · Other software · frappe · reported by GitHubMedium 4.3
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 15, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-55242 · Other software · frappe · reported by GitHubHigh 8.8
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 13, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-44448 · Other software · frappe · reported by GitHubMedium 5.9
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 15.102.0 and 16.11.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 13, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-44447 · Other software · frappe · reported by GitHubHigh 8.8
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 13, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-44446 · Other software · frappe · reported by GitHubHigh 8.8
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 13, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-44445 · Other software · frappe · reported by GitHubMedium 5.3
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive configuration files. This vulnerability is fixed in 15.104.3 and 16.12.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 13, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-44442 · Other software · frappe · reported by GitHubCritical 9.9
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 13, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-44441 · Other software · frappe · reported by GitHubMedium 5
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoint, which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 15.106.0 and 16.16.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 13, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-44440 · Other software · frappe · reported by GitHubMedium 6.5
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and 16.10.0, an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability on an endpoint allows an authenticated adjacent attacker to read arbitrary files. This vulnerability is fixed in 15.101.1 and 16.10.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 8, 2026Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.CVE-2025-67486 · Other software · Dolibarr · reported by GitHubHigh 8.6
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.
Product
dolibarr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com medium.com
Apr 17, 2026Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.CVE-2026-23500 · Other software · Dolibarr · reported by GitHubCritical 9.4
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.
Product
dolibarr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 30, 2026Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.CVE-2026-34036 · Other software · Dolibarr · reported by GitHubMedium 6.5
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local File Inclusion (LFI) vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail-open logic flaw in the core access control function restrictedArea(), an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as .env, .htaccess, configuration backups, or logs…). At time of publication, there are no publicly available patches.
Product
dolibarr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 20, 2026ERP is a free and open source Enterprise Resource Planning tool.CVE-2026-32954 · Other software · frappe · reported by GitHubHigh 7.1
ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 21, 2026ERP is a free and open source Enterprise Resource Planning tool.CVE-2026-27471 · Other software · frappe · reported by GitHubCritical 9.3
ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 4, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-25514 · Other software · NeoRazorX · reported by GitHubHigh 8.7
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.
Product
facturascripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 4, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-25513 · Other software · NeoRazorX · reported by GitHubHigh 8.3
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.
Product
facturascripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 2, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-23997 · Other software · NeoRazorX · reported by GitHubHigh 8
FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.
Product
facturascripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 2, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-23476 · Other software · NeoRazorX · reported by GitHubMedium 5.4
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.
Product
facturascripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 30, 2025FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2025-69210 · Other software · NeoRazorX · reported by GitHubLow 1.2
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.
Product
facturascripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record facturascripts.com github.com
Sep 5, 2025ERP is a free and open source Enterprise Resource Planning tool.CVE-2025-58439 · Other software · frappe · reported by GitHubHigh 8.1
ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left certain endpoints vulnerable to error-based SQL Injection. Some information like version could be retrieved. This issue is fixed in versions 14.89.2 and 15.76.0.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2024No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software.CVE-2024-49373 · Other software · nofusscomputing · reported by GitHubMedium 4.1
No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects within organizations they are not apart of. Version 1.2.1 fixes the problem.
Product
centurion_erp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 25, 2024Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.CVE-2024-23817 · Other software · Dolibarr · reported by GitHubHigh 7.1
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.
Product
dolibarr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 19, 2022Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.CVE-2022-34001 · Other software · Unit4 · reported by MITREMedium 6.5
Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.
Product
Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record prisminfosec.com prisminfosec.com
Dec 21, 2021Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control.CVE-2021-44877 · Other software · Dalmark · reported by MITREHigh 7.5
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability has been found while using a temporary generated token in order to consume api resources. The vulnerability allows an unauthenticated attacker to use an api endpoint to generate a temporary JWT token that is designed to reference the correct tenant prior to authentication, to request system configuration parameters using direct api requests. The correct exploitation of this vulnerability causes sensitive information exposure. In case the tenant has an smtp credential set, the full credential information is disclosed.
Product
Systeam Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record systeam.com.br systeam.com.br
Dec 21, 2021Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration.CVE-2021-44876 · Other software · Dalmark · reported by MITREMedium 5.3
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the identification of the correct tenant for a given user, where a difference in messages could allow an attacker to determine if the given user is valid or not, enabling a brute force attack with valid users.
Product
Systeam Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record systeam.com.br systeam.com.br
Dec 21, 2021Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration.CVE-2021-44875 · Other software · Dalmark · reported by MITREMedium 5.3
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the password recovery procedure for a given user, where a difference in messages could allow an attacker to determine if the given user is valid or not, enabling a brute force attack with valid users.
Product
Systeam Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record systeam.com.br systeam.com.br
Dec 21, 2021Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query.CVE-2021-44874 · Other software · Dalmark · reported by MITREHigh 8.8
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report module exposes direct SQL commands via POST data in order to select data for report generation. A malicious actor can use the bi report endpoint as a direct SQL prompt under the authenticated user.
Product
Systeam Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record systeam.com.br systeam.com.br
Apr 8, 2021Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through moduleCVE-2021-30114 · Other software · Web-school · reported by MITREMedium 6.5
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through module/accounting/voucher/create. The application fails to validate the CSRF token for a POST request using admin privilege.
Product
Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-school.in github.com
Apr 8, 2021A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields.CVE-2021-30113 · Other software · Web-school · reported by MITREMedium 6.1
A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attacker website.
Product
Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-school.in github.com
Apr 8, 2021Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request throCVE-2021-30112 · Other software · Web-school · reported by MITREMedium 6.5
Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request through module/core/studentleaveapplication/create. The application fails to validate the CSRF token for a POST request using Guardian privilege.
Product
Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-school.in github.com
Apr 8, 2021A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields.CVE-2021-30111 · Other software · Web-school · reported by MITREMedium 5.4
A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. An attack can inject a JavaScript code that will be stored in the page. If any visitor sees the events, then the payload will be executed.
Product
Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-school.in github.com
Aug 2, 2019IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain texCVE-2018-1987 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain text in the ERP trace file. IBM X-Force ID: 154280.
Product
Spectrum Protect for Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Jan 22, 2015The Dealer Portal in SAP ERP does not properly restrict access, which allows remote attackers to obtain sensitive information, gain privileges, and possibly havCVE-2015-1312 · Network & remote access · SAP · reported by MITREHigh 7.5
The Dealer Portal in SAP ERP does not properly restrict access, which allows remote attackers to obtain sensitive information, gain privileges, and possibly have other unspecified impact via unknown vectors, aka SAP Note 2000401. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Enterprise Resource Planning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record erpscan.io erpscan.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.