CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 22/06/2022 |
| CVE-2020-6145 | ÉLEVÉE8.8 | An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. | 10/08/2020 |
| CVE-2019-20521 | MOYENNE6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. | 19/03/2020 |
| CVE-2019-20520 | MOYENNE6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. | 19/03/2020 |
| CVE-2019-20519 | MOYENNE6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address. | 19/03/2020 |
| CVE-2019-20518 | MOYENNE6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. | 19/03/2020 |
| CVE-2019-20517 | MOYENNE6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. | 19/03/2020 |
| CVE-2019-20516 | MOYENNE6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. | 19/03/2020 |
| CVE-2019-20515 | MOYENNE6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. | 19/03/2020 |
| CVE-2019-20514 | MOYENNE6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. | 19/03/2020 |
| CVE-2019-20511 | MOYENNE6.1 | ERPNext 11.1.47 allows blog?blog_category= Frame Injection. | 18/03/2020 |
| CVE-2018-20061 | ÉLEVÉE7.5 | A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Pytho | 11/12/2018 |
| CVE-2018-3885 | ÉLEVÉE8.8 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The order_by parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and | 12/09/2018 |
| CVE-2018-3884 | ÉLEVÉE8.8 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sort_by and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabili | 12/09/2018 |
| CVE-2018-3883 | ÉLEVÉE8.8 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sort_order parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulne | 12/09/2018 |
| CVE-2018-3882 | ÉLEVÉE8.8 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, | 12/09/2018 |
| CVE-2018-11339 | MOYENNE6.1 | An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. | 22/05/2018 |