Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
1 selected

2 records

Release: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting 1.12.4 Clear all filters
TI-2023-02570 CVE-2023-2744 · GHSA-3hmp-qggx-jm2c

WP ERP < 1.12.4 - Admin+ SQL Injection

Priority HIGH 67

The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection expl…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02632 Published 2023-06-27 Fixed in 1.12.4
TI-2023-02569 CVE-2023-2743 · GHSA-jhmf-mhgj-hjcw

WP ERP < 1.12.4 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privileg…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-06-27 Fixed in 1.12.4