CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20517
https://notcve.org/view.php?id=CVE-2019-20517
19 Mar 2020 — ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. ERPNext versión 11.1.47, permite un ataque de tipo XSS reflejado por medio del PATH_INFO en el URI contact/. • https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20516
https://notcve.org/view.php?id=CVE-2019-20516
19 Mar 2020 — ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. ERPNext versión 11.1.47, permite un ataque de tipo XSS reflejado por medio del PATH_INFO en el URI blog/. • https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20515
https://notcve.org/view.php?id=CVE-2019-20515
19 Mar 2020 — ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. ERPNext versión 11.1.47, permite un ataque de tipo XSS reflejado por medio del PATH_INFO en el URI addresses/. • https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20514
https://notcve.org/view.php?id=CVE-2019-20514
19 Mar 2020 — ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. ERPNext versión 11.1.47, permite un ataque de tipo XSS reflejado por medio del PATH_INFO en el URI address/. • https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20511
https://notcve.org/view.php?id=CVE-2019-20511
18 Mar 2020 — ERPNext 11.1.47 allows blog?blog_category= Frame Injection. ERPNext versión 11.1.47, permite una Inyección de Trama de blog?blog_category=. • https://www.netsparker.com/web-applications-advisories/ns-19-018-frame-injection-in-erpnext • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2018-20061
https://notcve.org/view.php?id=CVE-2018-20061
11 Dec 2018 — A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to... • https://github.com/frappe/erpnext/issues/15337 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 6%CPEs: 1EXPL: 4CVE-2018-11339 – ERPnext 11 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-11339
22 May 2018 — An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. Se ha descubierto un problema de Cross-Site Scripting (XSS) en Frappe ERPNext v11.x.x-develop b1036e5 mediante un comentario. ERPnext version 11.x.x suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/147798 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •