Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Vendor: Simple SA Clear all filters
TI-2026-27139 CVE-2026-34907 · GHSA-vxh9-pjmh-2356

Reflected Cross-Site Scripting (XSS) in Wirtualna Uczelnia

Priority LOW 29

Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple endpoints.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00285 Published 2026-06-02 No fix listed CWE-79
TI-2026-27138 CVE-2026-34906 · GHSA-4pqh-3f6p-63c5

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia

Priority MEDIUM 49

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00557 Published 2026-06-02 No fix listed CWE-1336
TI-2026-00925 CVE-2026-1198 · GHSA-ggxg-6g5h-6m7w

SQL Injection in SIMPLE.ERP

Priority LOW 39

SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00317 Published 2026-02-26 Fixed in [email protected]_u06 CWE-89
TI-2025-11134 CVE-2025-12140 · GHSA-4cgm-43x9-f8f3

RCE in Wirtualna Uczelnia

Priority MEDIUM 48

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0044 Published 2025-11-27 Fixed in wu#2016.1.5513#0#20251014_113353 CWE-95
TI-2025-08561 CVE-2025-9339 · GHSA-v2v4-h7pw-r8p3

SQL Injection in SIMPLE.ERP

Priority LOW 31

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00281 Published 2025-10-21 Fixed in [email protected] CWE-89
TI-2024-08140 CVE-2024-8774 · GHSA-2v44-wc7v-87rm

Privilege Escalation in SIMPLE.ERP

Priority LOW 36

The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00343 Published 2025-03-24 Fixed in [email protected] CWE-257
TI-2024-08139 CVE-2024-8773 · GHSA-69m8-336v-j57w

Protocol Downgrade in SIMPLE.ERP

Priority LOW 36

SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.0045 Published 2025-03-24 Fixed in [email protected] CWE-757
TI-2019-05993 CVE-2019-8350 · GHSA-mjp6-fq4v-qgrp

The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for…

Priority LOW 30

The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for Android was affected by an information disclosure vulnerability that leaked the user's password to the keyboard autocomplete functionali…

CVSS 3.0MEDIUM 6.8 Physical No auth No interaction EPSS 0.00328 Published 2019-05-13 No fix listed CWE-522