Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Aug 13, 2026WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry.CVE-2026-49827 · Other software · SMEWebify · reported by GitHubCritical 9.8
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.
- Product
- WebErpMesv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication.CVE-2020-37082 · Other software · Weberp · reported by VulnCheckHigh 8.6
webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.
- Product
- webERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweberp.orgsourceforge.net
Jan 12, 2026WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry.CVE-2026-22789 · Other software · SMEWebify · reported by GitHubMedium 5.4
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19.
- Product
- WebErpMesv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry.CVE-2026-22788 · Other software · SMEWebify · reported by GitHubHigh 8.2
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.
- Product
- WebErpMesv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller.CVE-2025-52130 · Other software · reported by MITREMedium 5.4
File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload intCVE-2025-46053 · Other software · Weberp · reported by MITREMedium 5.1
A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a CVE-2025-46052 · Other software · Weberp · reported by MITRECritical 9.8
An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13.CVE-2025-2715 · Other software · timschofield · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatch_Invoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- webERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.CVE-2020-22474 · Other software · Weberp · reported by MITREMedium 6.5
In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlyhinslab.orglyhinslab.org
Mar 30, 2020In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbitrCVE-2019-7755 · Other software · Weberp · reported by MITREHigh 8.8
In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbitrary SQL queries, aka SQL Injection.
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-database.netexploit-db.com
Jul 4, 2019A SQL Injection issue was discovered in webERP 4.15.CVE-2019-13292 · Other software · Weberp · reported by MITRECritical 9.8
A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no sanitizing checks.
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 23, 2018In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creatiCVE-2018-20420 · Other software · Weberp · reported by MITREMedium 4.9
In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2018An issue was discovered in the Manufacturing component in webERP 4.15.CVE-2018-19436 · Other software · Weberp · reported by MITREHigh 7.2
An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter.
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2018An issue was discovered in the Sales component in webERP 4.15.CVE-2018-19435 · Other software · Weberp · reported by MITREHigh 7.2
An issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parameter.
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2018An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15.CVE-2018-19434 · Other software · Weberp · reported by MITREHigh 7.2
An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind SQL injection via the AmtClear_ parameter.
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2010Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remCVE-2010-1315 · Websites & servers · Joomlamo · reported by MITREMedium 5
Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.
- Product
- COM Weberpcustomer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Mar 16, 2010Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a ..CVE-2010-0982 · Websites & servers · Joomlamo · reported by MITREMedium 4.3
Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
- Product
- COM Cartweberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.