CVE-2025-1887 | | | 2025-03-07 | SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administra… |
CVE-2025-1886 | | | 2025-03-07 | Pass-Back vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges t… |
CVE-2024-48648 | Medium | 6.1 | 2024-10-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. This vulnerability allows attackers to inject malicious scripts into URLs… |
CVE-2024-48647 | High | 7.2 | 2024-10-30 | A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file syste… |
CVE-2024-48646 | High | 8.1 | 2024-10-30 | An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An attacker coul… |
CVE-2023-2809 | High | 7.8 | 2023-10-04 | Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database… |
CVE-2023-31868 | Medium | 5.4 | 2023-06-22 | Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, tho… |
CVE-2023-31867 | High | 7.2 | 2023-06-22 | Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. |
CVE-2023-29927 | Medium | 4.3 | 2023-05-16 | Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a w… |
CVE-2022-41400 | Critical | 9.8 | 2023-04-28 | Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in… |
CVE-2022-41399 | High | 7.5 | 2023-04-28 | The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database conn… |
CVE-2022-41398 | High | 7.5 | 2023-04-28 | The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue… |
CVE-2022-41397 | Critical | 9.8 | 2023-04-28 | The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and… |
CVE-2022-38583 | High | 7.8 | 2023-04-28 | On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privile… |
CVE-2019-25053 | High | 7.5 | 2023-01-27 | A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tr… |
CVE-2022-34324 | High | 8.8 | 2023-01-01 | Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment… |
CVE-2022-34323 | Medium | 5.4 | 2023-01-01 | Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' bro… |
CVE-2022-34322 | Critical | 9.0 | 2023-01-01 | Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browse… |
CVE-2021-45492 | High | 7.8 | 2022-07-14 | In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH e… |
CVE-2020-7390 | Medium | 4.6 | 2021-07-22 | Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address"… |
CVE-2020-7389 | Medium | 5.5 | 2021-07-22 | Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web app… |
CVE-2020-7388 | Critical | 10.0 | 2021-07-22 | Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can b… |
CVE-2020-7387 | Medium | 5.3 | 2021-07-22 | Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directo… |
CVE-2020-13893 | Medium | 5.4 | 2020-10-18 | Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via m… |
CVE-2017-3183 | High | 8.8 | 2018-07-24 | Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to pr… |
CVE-2007-0896 | | | 2007-02-13 | Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web… |
CVE-2006-4712 | | | 2006-09-12 | Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:enc… |
CVE-2006-4711 | | | 2006-09-12 | Multiple cross-site scripting (XSS) vulnerabilities in Sage allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated… |
CVE-2003-1243 | | | 2003-12-31 | Cross-site scripting vulnerability (XSS) in Sage 1.0 b3 allows remote attackers to insert arbitrary HTML or web script via the mod parameter. |
CVE-2003-1242 | | | 2003-12-31 | Sage 1.0 b3 allows remote attackers to obtain the root web server path via a URL request for a non-existent module, which returns the path in an error message. |