Unit4

10 CVEs across 6 Unit4 products. Browse Unit4 vulnerabilities, severities, and proof-of-concept exploits.

Unit4 products with known CVEs

ProductCVEs
Mik.starlight4
Teta Web2
Enterprise Resource Planning1
Financials By Coda1
Prosoft Hrms1
Teta1
Unit4 CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-28735High8.12024-03-20Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user…
CVE-2022-34001Medium6.52022-07-19Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.
CVE-2022-27434Critical9.82022-07-18UNIT4 TETA Mobile Edition (ME) before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting pag…
CVE-2021-36234Medium5.52021-08-31Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors.
CVE-2021-36233Medium6.52021-08-31The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the file…
CVE-2021-36232High8.82021-08-31Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges.
CVE-2021-36231High8.82021-08-31Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands…
CVE-2015-1174Critical9.82017-08-02Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a se…
CVE-2015-11732015-09-16Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode modules, which all…
CVE-2015-20822015-02-25Cross-site scripting (XSS) vulnerability in Login.aspx in UNIT4 Prosoft HRMS before 8.14.330.43 allows remote attackers to inject arbitrary web script or HTML…