Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2737▼ 484 respecto a la semana anterior
Críticas / altas1302▼ 187 respecto a la semana anterior
Nueva explotación activa (KEV)3▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)227▼ 275 respecto a la semana anterior
208 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Crítica (9.8) | 2.6% | — | Frappe | 12/8/2019 | 17/6/2026 | An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists. | |
| Modificada | Alta (7.5) | 1.4% | — | Frappe Erpnext | 11/12/2018 | 17/6/2026 | A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side… | |
| Modificada | Alta (8.8) | 0.94% | — | Frappe Erpnext | 12/9/2018 | 17/6/2026 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The order_by parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities,… | |
| Modificada | Alta (8.8) | 0.94% | — | Frappe Erpnext | 12/9/2018 | 17/6/2026 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sort_by and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these… | |
| Modificada | Alta (8.8) | 0.94% | — | Frappe Erpnext | 12/9/2018 | 17/6/2026 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sort_order parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these… | |
| Modificada | Alta (8.8) | 0.94% | — | Frappe Erpnext | 12/9/2018 | 17/6/2026 | An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities,… | |
| Modificada | Media (6.1) | 3.8% | 💥 Exploit | Frappe Erpnext | 22/5/2018 | 17/6/2026 | An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. | |
| Modificada | Alta (8.8) | 1.1% | — | Frappe | 5/10/2017 | 17/6/2026 | [ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter. |