CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2018-20061
https://notcve.org/view.php?id=CVE-2018-20061
11 Dec 2018 — A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to... • https://github.com/frappe/erpnext/issues/15337 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 6%CPEs: 1EXPL: 4CVE-2018-11339 – ERPnext 11 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-11339
22 May 2018 — An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. Se ha descubierto un problema de Cross-Site Scripting (XSS) en Frappe ERPNext v11.x.x-develop b1036e5 mediante un comentario. ERPnext version 11.x.x suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/147798 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •