TI-2025-41974 CVE-2025-68421 · GHSA-8j5g-5398-wgwq
Hardcoded credentials in Comarch ERP Optima
Priority LOW 39
Comarch ERP Optima client makes use of a hard-coded password for a database user.
Comarch
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Comarch records in CISA KEVNo Comarch vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2023-04183 CVE-2023-4537 · GHSA-58qw-vfcj-x2hg
Protocol Downgrade in Comarch ERP XL
Priority LOW 35
Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.
TI-2025-41973 CVE-2025-68420 · GHSA-8cw5-3v42-mc6r
Privilege Escalation in Comarch ERP Optima
Priority LOW 34
Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in.
TI-2023-04185 CVE-2023-4539 · GHSA-p74r-mvhv-7jx7
Hardcoded password in Comarch ERP XL
Priority LOW 33
Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database.
TI-2023-04184 CVE-2023-4538 · GHSA-4g2f-j53w-6jfc
Shared Key in Comarch ERP XL
Priority LOW 29
The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations.