Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Tryton Component: Trytond Clear all filters
TI-2025-40860 CVE-2025-66424 · GHSA-2w93-qwpp-vgvj

Incorrect authorization in trytond

Priority LOW 28

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00257 Published 2025-11-30 Fixed in 6.0.70, 7.0.40 +2 CWE-863
TI-2025-40859 CVE-2025-66423 · GHSA-p3p5-xrmv-4j6x

Incorrect authorization in trytond

Priority LOW 31

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00242 Published 2025-11-30 Fixed in 6.0.70, 7.0.40 +2 CWE-863
TI-2022-09934 CVE-2022-26661 · GHSA-cj78-rgw3-4h5p

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45…

Priority LOW 32

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01407 Published 2022-03-07 Fixed in 5.0.46, 6.0.16 +4 CWE-611
TI-2022-09935 CVE-2022-26662 · GHSA-pm3h-mm62-pwm8

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform…

Priority LOW 37

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01973 Published 2022-03-07 Fixed in 5.0.46, 6.0.16 +4 CWE-776
TI-2019-08092 CVE-2019-10868 · GHSA-f6f2-pwrj-64h3

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6…

Priority LOW 31

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no ac…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01288 Published 2019-04-05 Fixed in 4.2.21, 4.4.19 +3 CWE-862
TI-2015-00802 CVE-2015-0861 · GHSA-c8q5-2j73-qvcc

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before…

Priority LOW 22

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0115 Published 2016-04-13 Fixed in 3.2.10, 3.4.8 +2 CWE-264
TI-2012-00208 CVE-2012-0215 · GHSA-cqg4-rf29-3mv6

model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for…

Priority LOW 29

model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modif…

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.02021 Published 2012-07-12 Fixed in 2.4.0 CWE-264