Sagedpw Sage Dpw
10 CVEs affecting Sagedpw Sage Dpw. Latest disclosed: 2026-04-01. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56883 | High | 8.1 | 2025-02-18 | Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. L… |
CVE-2025-51532 | High | 7.5 | 2025-08-06 | Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The v… |
CVE-2025-51531 | Medium | 6.1 | 2025-08-06 | A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript in the context of a v… |
CVE-2020-26584 | Medium | 6.1 | 2020-10-16 | An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. The search field "Kurs suchen" on the page Kurskatalog is vulnerable to Reflected XSS. If the… |
CVE-2020-26583 | Medium | 6.1 | 2020-10-16 | An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. It allows unauthenticated users to upload JavaScript (in a file) via the expenses claiming fu… |
CVE-2025-67805 | Medium | 5.9 | 2026-04-01 | A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensiti… |
CVE-2024-56882 | Medium | 5.4 | 2025-02-18 | Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScri… |
CVE-2025-51533 | Medium | 5.3 | 2025-08-07 | An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET… |
CVE-2025-67807 | Medium | 4.7 | 2026-04-01 | The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |
CVE-2025-67806 | Low | 3.7 | 2026-04-01 | The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |