HIGH🇵🇱 Wersja polska

CVE-2007-1437

CVSS 9.0v2.0pub. 2007-03-13upd. 2026-04-23

Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to overwrite files and possibly bypass authentication, and remote authenticated users to execute unauthorized code, by calling a custom error function that returns from execution.

CVSS Vector
AV:N/AC:L/Au:S/C:C/I:C/A:C

  • Ledgersmb

    APP
    Ledgersmb
    1.0.01.1.01.1.1

  • Sql Ledger

    APP
    Sql-Ledger
    ≤ 2.6.24
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2018-9246CRITICAL9.8ten sam produkt

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently...

CVE-2024-23831HIGH7.5ten sam produkt

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an a...

CVE-2021-3693HIGH8.8ten sam produkt

LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially cr...

CVE-2021-3694HIGH8.2ten sam produkt

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted...

CVE-2009-4402HIGH7.5ten sam produkt

The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative o...