GCVE - cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:tryton:tryton:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Tryton (`6676310b-e59a-5204-9937-d4dd2ec558e1`)
Product	Tryton (`08f959a5-873a-5930-bd27-52982618bfbe`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/tryton-client`	purl2cpe	2026-06-01 10:15:41.093736
`pkg:deb/ubuntu/tryton-client`	purl2cpe	2026-06-01 10:15:41.093738
`pkg:github/tryton/tryton`	purl2cpe	2026-06-01 10:15:41.093740
`pkg:rpm/fedora/tryton`	purl2cpe	2026-06-01 10:15:41.093741
`pkg:rpm/opensuse/tryton`	purl2cpe	2026-06-01 10:15:41.093742

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-37014`	vulnerable	2026-06-08 05:25:50.006812	Tryton 5.4 - Persistent Cross-Site Scripting MEDIUM (6.4) Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces. Published: 2026-01-30T16:16:38.719Z Updated: 2026-05-14T02:06:48.585Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48466 https://www.tryton.org/ https://www.tryton.org/download https://www.vulnerability-lab.com/get_content.php?id=2233 https://www.vulncheck.com/advisories/tryton-persistent-cross-site-scripting	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-1242`	vulnerable	2026-06-08 05:07:26.991436	Details available file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors. Published: 2016-09-07T19:00:00.000Z Updated: 2024-08-05T22:48:13.633Z Open on db.gcve.eu Reference links http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html http://www.debian.org/security/2016/dsa-3656 https://bugs.tryton.org/issue5808	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-1241`	vulnerable	2026-06-08 05:07:26.975915	Details available Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors. Published: 2016-09-07T19:00:00.000Z Updated: 2024-08-05T22:48:13.788Z Open on db.gcve.eu Reference links http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html https://bugs.tryton.org/issue5795 http://www.debian.org/security/2016/dsa-3656	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6633`	vulnerable	2026-06-08 05:05:58.098486	Details available The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module. Published: 2018-04-12T15:00:00.000Z Updated: 2024-08-06T12:24:35.619Z Open on db.gcve.eu Reference links http://www.tryton.org/posts/security-release-for-issue4155.html https://bugs.tryton.org/issue4155	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.