Simple.ERP vulnerabilities
4 known vulnerabilities in Simple.ERP from Simple SA. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.6 High severity
Simple.ERP: Improper Neutralization of Special Elements used in an SQL Command
SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed. This issue was fixed in 6.30@A04.
- 7.1 High severity
SIMPLE.ERP: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to d
- 7.7 High severity
SIMPLE.ERP: Storing Passwords in a Recoverable Format
The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch
- 8.3 High severity
SIMPLE.ERP: Selection of Less-Secure Algorithm During Negotiation
SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version rec