| CVE-2022-23058 | 低危3.5 | ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover. | 22/06/2022 |
| CVE-2022-23057 | 中危5.4 | In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile. | 22/06/2022 |
| CVE-2022-23056 | 低危3.5 | In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack. | 22/06/2022 |
| CVE-2020-6145 | 高危8.8 | An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. | 10/08/2020 |
| CVE-2019-20521 | 中危6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. | 19/03/2020 |
| CVE-2019-20520 | 中危6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. | 19/03/2020 |
| CVE-2019-20519 | 中危6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address. | 19/03/2020 |
| CVE-2019-20518 | 中危6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. | 19/03/2020 |
| CVE-2019-20517 | 中危6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. | 19/03/2020 |
| CVE-2019-20516 | 中危6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. | 19/03/2020 |
| CVE-2019-20515 | 中危6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. | 19/03/2020 |
| CVE-2019-20514 | 中危6.1 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. | 19/03/2020 |
| CVE-2019-20511 | 中危6.1 | ERPNext 11.1.47 allows blog?blog_category= Frame Injection. | 18/03/2020 |
| CVE-2018-20061 | 高危7.5 | A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Pytho | 11/12/2018 |
| CVE-2018-3885 | 高危8.8 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The order_by parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and | 12/09/2018 |
| CVE-2018-3884 | 高危8.8 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sort_by and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabili | 12/09/2018 |
| CVE-2018-3883 | 高危8.8 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sort_order parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulne | 12/09/2018 |
| CVE-2018-3882 | 高危8.8 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, | 12/09/2018 |
| CVE-2018-11339 | 中危6.1 | An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. | 22/05/2018 |