High severity8.8NVD Advisory· Published Sep 12, 2018· Updated May 8, 2026
CVE-2018-3884
CVE-2018-3884
Description
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sort_by and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Affected products
2- Talos/ERPNextv5Range: ERPNext v10.1.6 (master)
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- talosintelligence.com/vulnerability_reports/TALOS-2018-0560nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.