CVE-2020-37014 | Medium | 6.4 | 2026-01-30 | Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. At… |
CVE-2025-66424 | Medium | 6.5 | 2025-11-30 | Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. |
CVE-2025-66423 | High | 7.1 | 2025-11-30 | Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. |
CVE-2025-66422 | Medium | 4.3 | 2025-11-30 | Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6… |
CVE-2025-66421 | Medium | 5.4 | 2025-11-30 | Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69. |
CVE-2025-66420 | Medium | 5.4 | 2025-11-30 | Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67. |
CVE-2022-26662 | High | 7.5 | 2022-03-10 | An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through… |
CVE-2022-26661 | Medium | 6.5 | 2022-03-10 | An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Appli… |
CVE-2012-2238 | High | 7.5 | 2019-11-21 | trytond 2.4: ModelView.button fails to validate authorization |
CVE-2019-10868 | Medium | 6.5 | 2019-04-05 | In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated u… |
CVE-2018-19443 | Medium | 5.9 | 2018-11-22 | The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc… |
CVE-2014-6633 | High | 8.8 | 2018-04-12 | The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote a… |
CVE-2017-0360 | Medium | 5.3 | 2017-04-04 | file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with… |
CVE-2016-1242 | Medium | 4.4 | 2016-09-07 | file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with ce… |
CVE-2016-1241 | Medium | 5.3 | 2016-09-07 | Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user… |
CVE-2015-0861 | Medium | 4.3 | 2016-04-13 | model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypas… |
CVE-2013-4510 | | | 2013-11-18 | Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via… |
CVE-2012-0215 | | | 2012-07-12 | model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the rel… |