Eramba

10 CVEs across 1 Eramba products. Browse Eramba vulnerabilities, severities, and proof-of-concept exploits.

Eramba products with known CVEs

ProductCVEs
Eramba10
Eramba CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-55462Medium6.52026-01-13A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-A…
CVE-2023-36255High8.82023-08-03An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the UR…
CVE-2022-43342Medium5.42022-11-14A stored cross-site scripting (XSS) vulnerability in the Add function of Eramba GRC Software c2.8.1 allows attackers to execute arbitrary web scripts or HTML v…
CVE-2020-28031Medium4.32020-11-02eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users.
CVE-2020-25105Critical9.82020-09-03eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has only a million possibilities).
CVE-2020-25104Medium5.42020-09-03eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS pa…
CVE-2018-7997Medium6.12018-03-09Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious Jav…
CVE-2018-7996Medium6.12018-03-09Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter.
CVE-2018-7894Medium6.12018-03-09Eramba e1.0.6.033 has Reflected XSS in reviews/filterIndex/ThirdPartyRiskReview via the advanced_filter parameter (aka the Search Parameter).
CVE-2018-7741Medium6.12018-03-07Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI.