Vulnerabilities
Summary — last 7 days
New vulnerabilities4,639▼ 748 vs. last week
Critical / high1,741▼ 1,325 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)973▲ 874 vs. last week
More filters
8 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | Medium (6.5) | 0.25% | PoC | Doubo ERP Project Doubo ERP | 9/2/2025 | 6/17/2026 | Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. | |
| Modified | Critical (9.8) | 1.2% | — | Kuerp Project Kuerp | 1/29/2024 | 6/17/2026 | A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function del_sn_db of the file /application/index/controller/Service.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been… | |
| Modified | Critical (9.8) | 0.98% | — | Kuerp Project Kuerp | 1/29/2024 | 6/17/2026 | A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of the file /application/index/common.php. The manipulation of the argument App_User_id/App_user_Token leads to improper authentication. The exploit has been… | |
| Modified | Critical (9.8) | 0.87% | — | Kuerp Project Kuerp | 1/29/2024 | 6/17/2026 | A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit has been disclosed to the public and may be used. The identifier of this… | |
| Modified | High (8.8) | 0.50% | — | ERP Project ERP | 11/11/2022 | 6/17/2026 | A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file application/controllers/basedata/inventory.php of the component Commodity Management. The manipulation leads to unrestricted upload. The attack can be launched… | |
| Modified | Medium (6.1) | 0.47% | — | Salonerp Project Salonerp | 11/3/2022 | 6/17/2026 | SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks. | |
| Modified | High (8.8) | 3.1% | — | Kea-hotel-erp Project Kea-hotel-erp | 1/25/2022 | 6/17/2026 | In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service. | |
| Modified | High (8.8) | 1.8% | — | Salonerp Project Salonerp | 1/14/2022 | 6/17/2026 | In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password. |