107,314 results · Clear filters · Feed
-
Medium 6.5
Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially craft…
-
Medium 6.5
Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their …
-
Medium 4.3
Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated u…
-
Medium 4.3
Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned…
-
Medium 6.5
Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints …
-
Medium 6.5
Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints
Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensit…
-
Medium 6.5
Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financia…
-
Medium 6.5
Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the …
-
Medium 6.5
Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyo…
-
Medium 5.4
Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization
Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and d…
-
Medium 4.3
Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond…
-
Medium 6.5
Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip pe…
-
Medium 6.5
Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial re…
-
Medium 6.5
Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to c…
-
Medium 4.3
Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned…
-
Medium 6.5
Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data …
-
Medium 6.5
Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and e…
-
Medium 5.4
Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters
Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute sc…
-
Medium 5.3
Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity …
-
Medium 4.3
Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their …
-
Medium 4.3
Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions c…
-
Medium 5.4
Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents o…
-
Medium 5.5
Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS juncti…
-
Medium 5.5
Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports …
-
Medium 5.5
Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or sym…
-
Medium 5.3
Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these paramete…
-
Medium 5.4
Frappe before 15.91.1 Stored XSS via Leaderboard User Names
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitr…
-
Medium 4.3
Frappe before 15.4.0 XSS via Printview Parameters
Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, in…
-
Medium 6.5
Frappe before 13.46.3 Improper Access Control for Email Templates
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including…
-
Medium 5.9
Frappe before 13.32.0 Weak Authentication via Print View Key
Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without…
-
Medium 4.3
Frappe before 13.22.0 Improper Authorization via Document Rename
Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to mo…
-
Medium 4.8
Frappe before 13.46.1 XSS via html2text Weak Sanitization
Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing sc…
-
Medium 4.9
Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks
Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as crede…
-
Medium 6.1
Frappe before 14.31.0 HTML Injection via Weak Escaping
Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browser…
-
Medium 4.9
Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts
Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Serve…
-
Medium 4.3
Nango: Production flow RBAC bypass on private flow-read routes
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET …
-
Medium 4.3
FileRise: Missing CSRF enforcement for file creation and share-link creation
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token chec…
-
Medium 6.1
QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values
QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties value…
-
Medium 5.1
Code for IBM i: Temporary files are visible to all users
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory withou…
-
Medium 6.5
odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RE…