Vulnerabilities

TI-2019-15366 CVE-2019-25312 · GHSA-7gxv-gvrv-j982

InoERP 0.7.2 - Persistent Cross-Site Scripting

MEDIUM 56

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00275 Published 2026-02-11 No fix listed CWE-79

TI-2020-17422 CVE-2020-28870 · GHSA-74m2-4qpm-x6vm

In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side…

MEDIUM 48

In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_personalization/json_fp.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03263 Published 2021-02-10 No fix listed CWE-20

TI-2019-12599 CVE-2019-16894 · GHSA-g3r4-wpjm-93w3

download.php in inoERP 4.15 allows SQL injection through insecure deserialization.

MEDIUM 48

download.php in inoERP 4.15 allows SQL injection through insecure deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03022 Published 2019-09-26 No fix listed CWE-502

Vulnerabilities

Filters

InoERP 0.7.2 - Persistent Cross-Site Scripting

In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side…

download.php in inoERP 4.15 allows SQL injection through insecure deserialization.