Weberp

weberp

11 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (11)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-37082 1Weberp 1Weberp Feb 11, 2026 Feb 3, 2026 8.6 HIGH· v4 7.5 HIGH· v3 N/A· v2 webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the compa...Show more webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.Show less
CVE-2025-46053 1Weberp 1Weberp Jun 12, 2025 May 15, 2025 N/A· v4 5.1 MEDIUM· v3 N/A· v2 A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST...Show more A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.phpShow less
CVE-2025-46052 1Weberp 1Weberp Jun 12, 2025 May 15, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to...Show more An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.phpShow less
CVE-2015-10018 1Weberp 1D2files Nov 21, 2024 Jan 6, 2023 N/A· v4 9.8 CRITICAL· v3 5.2 MEDIUM· v2 A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipul...Show more A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.Show less
CVE-2020-22474 1Weberp 1Weberp Nov 21, 2024 Feb 22, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.
CVE-2019-7755 1Weberp 1Weberp Nov 21, 2024 Mar 30, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbitrary SQL queries, aka SQL Injection.
CVE-2019-13292 1Weberp 1Weberp Nov 21, 2024 Jul 4, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no san...Show more A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no sanitizing checks.Show less
CVE-2018-20420 1Weberp 1Weberp Nov 21, 2024 Dec 24, 2018 N/A· v4 4.9 MEDIUM· v3 5.5 MEDIUM· v2 In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the...Show more In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.Show less
CVE-2018-19436 1Weberp 1Weberp Nov 21, 2024 Nov 22, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter.
CVE-2018-19435 1Weberp 1Weberp Nov 21, 2024 Nov 22, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parameter.
CVE-2018-19434 1Weberp 1Weberp Nov 21, 2024 Nov 22, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind SQL injection via the AmtClear_ parameter.