← Vulnerability feed

Vulnerability record · CVE-2019-7755 · published 30 March 2020

CVE-2019-7755: Weberp sql injection vulnerability

Weberp · Weberp

In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbitrary SQL queries, aka SQL Injection.

8.8 CVSS 3.1 High EPSS 2.1% · top 18.6% CWE-89 · SQL injection
8.8CVSS 3.1 base score, v2 6.5
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbitrary SQL queries, aka SQL Injection.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.exploit-database.net/?id=101060 ExploitThird Party Advisory
https://www.exploit-db.com/exploits/46431/ Broken Link
https://www.weberp.org Broken Link
https://www.exploit-database.net/?id=101060 ExploitThird Party Advisory
https://www.exploit-db.com/exploits/46431/ Broken Link
https://www.weberp.org Broken Link

Track CVE-2019-7755 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-46052Weberp sql injection vulnerabilityAn error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by i…EPSS 0.50%9.8CVE-2019-13292Weberp sql injection vulnerabilityA SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. T…EPSS 9.3%8.6CVE-2020-37082Weberp vulnerabilitywebERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentica…EPSS 0.57%7.2CVE-2018-19434Weberp sql injection vulnerabilityAn issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind S…EPSS 1.1%7.2CVE-2018-19435Weberp sql injection vulnerabilityAn issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parameter.EPSS 1.1%7.2CVE-2018-19436Weberp sql injection vulnerabilityAn issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parame…EPSS 1.1%6.5CVE-2020-22474Weberp inclusion from untrusted sphere vulnerabilityIn webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.EPSS 1.0%5.1CVE-2025-46053Weberp sql injection vulnerabilityA SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted …EPSS 0.24%

Source: NIST National Vulnerability Database (record CVE-2019-7755), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.