https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-34001.htmlhttps://patchthecve.com/cve/CVE-2022-34001.htmlWed, 17 Jun 2026 04:49:38 +0000MEDIUM 6.5: Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.https://patchthecve.com/cve/CVE-2021-30114.htmlhttps://patchthecve.com/cve/CVE-2021-30114.htmlWed, 17 Jun 2026 03:49:41 +0000MEDIUM 6.5: Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a voucher payment request through module/accounting/voucher/create. The application fails to validate the CSRF token for a POST request using admin privilege.https://patchthecve.com/cve/CVE-2021-30113.htmlhttps://patchthecve.com/cve/CVE-2021-30113.htmlWed, 17 Jun 2026 03:49:41 +0000MEDIUM 6.1: A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attackehttps://patchthecve.com/cve/CVE-2021-30112.htmlhttps://patchthecve.com/cve/CVE-2021-30112.htmlWed, 17 Jun 2026 03:49:41 +0000MEDIUM 6.5: Web-School ERP V 5.0 contains a cross-site request forgery (CSRF) vulnerability that allows a remote attacker to create a student_leave_application request through module/core/studentleaveapplication/create. The application fails to validate the CSRF token for a POST request using Guardian privilegehttps://patchthecve.com/cve/CVE-2021-30111.htmlhttps://patchthecve.com/cve/CVE-2021-30111.htmlWed, 17 Jun 2026 03:49:41 +0000MEDIUM 5.4: A stored XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in the event name and description fields. An attack can inject a JavaScript code that will be stored in the page. If any visitor sees the events, then the payload will be executed.https://patchthecve.com/cve/CVE-2015-1312.htmlhttps://patchthecve.com/cve/CVE-2015-1312.htmlWed, 17 Jun 2026 00:22:10 +0000HIGH 7.5: The Dealer Portal in SAP ERP does not properly restrict access, which allows remote attackers to obtain sensitive information, gain privileges, and possibly have other unspecified impact via unknown vectors, aka SAP Note 2000401. NOTE: the provenance of this information is unknown; the details are