Vulnerabilities

TI-2025-16797 CVE-2025-22953 · GHSA-q87j-52xg-48j5

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available…

MEDIUM 53

A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01834 Published 2025-03-28 No fix listed CWE-89

TI-2015-01970 CVE-2015-2210 · GHSA-cpw6-5jfx-2w4c

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to…

LOW 35

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00632 Published 2017-09-06 No fix listed CWE-77

TI-2014-03533 CVE-2014-4311 · GHSA-qvhc-67r6-hr3h

Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1)…

LOW 32

Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mail Connection passwords by reading HTML source code of the database connection and email settings pag…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.05783 Published 2014-11-04 No fix listed CWE-200

TI-2014-03535 CVE-2014-4313 · GHSA-xvxr-4f6g-g73v

SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers…

LOW 37

SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User field.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02164 Published 2014-10-10 No fix listed CWE-89

TI-2014-03534 CVE-2014-4312 · GHSA-rvhg-jhq4-7wh7

Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before…

LOW 27

Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the (1) Notes section to Order details; (2) Des…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04179 Published 2014-10-10 No fix listed CWE-79