Vulnerabilities

TI-2024-32044 CVE-2024-47769

IDURAR has a Path Traversal (unauthenticated user can read sensitive data)

HIGH 66

IDURAR is open source ERP CRM accounting invoicing software.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00767 Published 2024-10-04 No fix listed CWE-22

TI-2024-16609 CVE-2024-25164 · GHSA-jqhq-7m2m-3xjx

iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated…

HIGH 72

iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00869 Published 2024-03-04 No fix listed CWE-22

TI-2023-28675 CVE-2023-52265 · GHSA-h9qp-4fch-g5rw

IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a…

MEDIUM 58

IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00402 Published 2023-12-30 No fix listed CWE-79

TI-2023-12384 CVE-2023-27742 · GHSA-8f72-jq63-76j6

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.

MEDIUM 51

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00934 Published 2023-05-16 No fix listed CWE-89

Vulnerabilities

Filters

IDURAR has a Path Traversal (unauthenticated user can read sensitive data)

iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated…

IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a…

IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.