Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
311 results · page 7 of 7
Mar 19, 2020ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.CVE-2019-20514 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 18, 2020In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentiCVE-2019-20529 · Other software · Frappe · reported by MITREHigh 7.5
In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private files.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2020ERPNext 11.1.47 allows blog?blog_category= Frame Injection.CVE-2019-20511 · Other software · Frappe · reported by MITREMedium 6.1
ERPNext 11.1.47 allows blog?blog_category= Frame Injection.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Aug 27, 2019public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed valCVE-2019-15700 · Other software · Frappe · reported by MITREMedium 6.1
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2019An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12.CVE-2019-14967 · Other software · Frappe · reported by MITREMedium 6.1
An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2019An issue was discovered in Frappe Framework 10 through 12 before 12.0.4.CVE-2019-14966 · Other software · Frappe · reported by MITREHigh 8.8
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2019An issue was discovered in Frappe Framework 10 through 12 before 12.0.4.CVE-2019-14965 · Other software · Frappe · reported by MITRECritical 9.8
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2018A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29.CVE-2018-20061 · Other software · Frappe · reported by MITREHigh 7.5
A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2018An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6.CVE-2018-3882 · Other software · Frappe · reported by talos-cna@cisco.comHigh 8.8
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
May 21, 2018An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.CVE-2018-11339 · Other software · Frappe · reported by MITREMedium 6.1
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.
- Product
- Erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.erpnext.comgithub.com
Oct 4, 2017[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands viCVE-2017-1000120 · Other software · Frappe · reported by MITREHigh 8.8
[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtech.mantz-it.comtech.mantz-it.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.