Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
frappe erpnext vulnerabilities and exploits
(subscribe to this query)
312
VMScore
CVE-2022-23056
In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.
Frappe Erpnext
Frappe Erpnext 13.0.0
490
VMScore
CVE-2022-23055
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker c...
Frappe Erpnext 11.0.3
Frappe Erpnext
445
VMScore
CVE-2018-20061
A SQL injection issue exists in ERPNext 10.x and 11.x up to and including 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaSc...
Frappe Erpnext
Frappe Erpnext 11.0.3
312
VMScore
CVE-2022-23058
ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.
Frappe Erpnext
312
VMScore
CVE-2022-23057
In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.
Frappe Erpnext
383
VMScore
CVE-2019-20511
ERPNext 11.1.47 allows blog?blog_category= Frame Injection.
Frappe Erpnext 11.1.47
383
VMScore
CVE-2019-20517
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
Frappe Erpnext 11.1.47
NA
CVE-2022-28598
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
Frappe Erpnext 12.29.0
383
VMScore
CVE-2019-20514
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
Frappe Erpnext 11.1.47
383
VMScore
CVE-2019-20515
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
Frappe Erpnext 11.1.47
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injection
CVE-2006-4304
CVE-2023-26603
CVE-2024-28327
CVE-2023-50363
CVE-2024-21905
template injection
CVE-2024-3400
cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »