Odoo vulnerabilities
We track 4 vulnerabilities in Odoo products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on February 25, 2025.
Latest Odoo vulnerabilities
- 8.8 High severity
Odoo Community: Improper Access Control
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- 7.3 High severity
odoo: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain privileges via the data parameter to models/ir_model.py:IrModel::chech_model.
- 7.3 High severity
odoo: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a remote attacker to gain privileges via a query to IZITools::query_check, IZITools::query_fetch, or IZITools::query_exec
- 9.8 Critical severity
Zkteco, Essl, Cams Biometrics Integration Module: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db param