Simple SA vulnerabilities
We track 6 vulnerabilities in Simple SA products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on June 2, 2026.
Latest Simple SA vulnerabilities
- 9.3 Critical severity
Wirtualna Uczelnia: Improper Neutralization of Special Elements Used in a Template Engine
Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrar
- 8.6 High severity
Simple.ERP: Improper Neutralization of Special Elements used in an SQL Command
SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed. This issue was fixed in 6.30@A04.
- 9.3 Critical severity
Wirtualna Uczelnia: Improper Neutralization of Directives in Dynamically Evaluated Code
The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer t
- 7.1 High severity
SIMPLE.ERP: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to d
- 7.7 High severity
SIMPLE.ERP: Storing Passwords in a Recoverable Format
The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch
- 8.3 High severity
SIMPLE.ERP: Selection of Less-Secure Algorithm During Negotiation
SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version rec