Skip to content
OpenAdvisories

Vendor

Sage

11 known vulnerabilities.

Products

X3 4 Sage 200 Spain 3 Sage AR Automation 2 Employee Self Service 1 XRT Treasury 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-67395

    A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validat…

    Sage Employee Self Service
  • Medium 4.6
    CVE-2020-7390

    Sage X3 Syracuse Persistent XSS in Edit User page

    Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version …

    Sage X3
  • Medium 5.5
    CVE-2020-7389

    Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment

    Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

    Sage X3
  • Medium 5.3
    CVE-2020-7387 Public exploit EPSS 34%

    Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor

    Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full R…

    Sage X3