CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20515
https://notcve.org/view.php?id=CVE-2019-20515
19 Mar 2020 — ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. ERPNext versión 11.1.47, permite un ataque de tipo XSS reflejado por medio del PATH_INFO en el URI addresses/. • https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20514
https://notcve.org/view.php?id=CVE-2019-20514
19 Mar 2020 — ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. ERPNext versión 11.1.47, permite un ataque de tipo XSS reflejado por medio del PATH_INFO en el URI address/. • https://www.netsparker.com/web-applications-advisories/ns-19-017-cross-site-scripting-in-erpnext • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20511
https://notcve.org/view.php?id=CVE-2019-20511
18 Mar 2020 — ERPNext 11.1.47 allows blog?blog_category= Frame Injection. ERPNext versión 11.1.47, permite una Inyección de Trama de blog?blog_category=. • https://www.netsparker.com/web-applications-advisories/ns-19-018-frame-injection-in-erpnext • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-20529
https://notcve.org/view.php?id=CVE-2019-20529
18 Mar 2020 — In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is required to access; having a link is sufficient) instead of private files. En el archivo core/doctype/prepared_report/prepared_report.py en Frappe versiones 11 y 12, los archivos de datos generados con Prepared Report estaban siendo almacenados como archivos públicos (ninguna autenticación es requerida para acceder; teniendo un enlace es su... • https://github.com/frappe/frappe/pull/8884 • CWE-306: Missing Authentication for Critical Function CWE-552: Files or Directories Accessible to External Parties •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15700
https://notcve.org/view.php?id=CVE-2019-15700
27 Aug 2019 — public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text. public/js/frappe/form/footer/timeline.js en Frappe Framework 12 a 12.0.8 no escapa al HTML en la línea de tiempo y, por lo tanto, se ve afectado por el texto creado "valor modificado de". • https://github.com/frappe/frappe/pull/8262 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-14965
https://notcve.org/view.php?id=CVE-2019-14965
12 Aug 2019 — An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists. Se detecto un problema en Frappe Framework versiones 10 a 12 antes de 12.0.4. Existe un problema de inyección de plantilla del lado del servidor (SSTI). • https://github.com/frappe/frappe/compare/v12.0.3...v12.0.4 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-14966
https://notcve.org/view.php?id=CVE-2019-14966
12 Aug 2019 — An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection. Se detecto un problema en Frappe Framework versiones 10 a 12 antes de 12.0.4. Existe una inyección SQL autenticada. • https://github.com/frappe/frappe/compare/v12.0.3...v12.0.4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-14967
https://notcve.org/view.php?id=CVE-2019-14967
12 Aug 2019 — An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability. Se detecto un problema en Frappe Framework versiones 10, 11 antes de 11.1.46 y 12. Existe una vulnerabilidad XSS. • https://github.com/frappe/frappe/compare/v11.1.45...v11.1.46 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2018-20061
https://notcve.org/view.php?id=CVE-2018-20061
11 Dec 2018 — A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to... • https://github.com/frappe/erpnext/issues/15337 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 6%CPEs: 1EXPL: 4CVE-2018-11339 – ERPnext 11 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-11339
22 May 2018 — An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. Se ha descubierto un problema de Cross-Site Scripting (XSS) en Frappe ERPNext v11.x.x-develop b1036e5 mediante un comentario. ERPnext version 11.x.x suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/147798 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •