Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data stored in the database.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.0057·Published 2024-12-18·Fixed in 8.90.0CWE-259
Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.
CVSS 4.0CRITICAL 9.1·Network·No auth·No interaction·EPSS 0.00924·Published 2024-12-18·Fixed in 9.00.0CWE-757