Trytond

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorTryton (6676310b-e59a-5204-9937-d4dd2ec558e1)
ProductTrytond (c1d78721-092f-5142-ad36-e44303f419e1)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/tryton-meta purl2cpe 2026-06-01 10:15:41.263287
pkg:deb/ubuntu/tryton-meta purl2cpe 2026-06-01 10:15:41.263289
pkg:github/tryton/trytond purl2cpe 2026-06-01 10:15:41.263290
pkg:rpm/fedora/trytond purl2cpe 2026-06-01 10:15:41.263292
pkg:rpm/opensuse/trytond purl2cpe 2026-06-01 10:15:41.263293

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-66424 vulnerable 2026-06-08 07:41:18.911954 Details available
MEDIUM (6.5)
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Published: 2025-11-30T00:00:00.000Z
Updated: 2025-12-01T14:10:29.733Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-66423 vulnerable 2026-06-08 07:41:18.911676 Details available
HIGH (7.1)
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Published: 2025-11-30T00:00:00.000Z
Updated: 2025-12-01T14:10:34.912Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-66422 vulnerable 2026-06-08 07:41:18.911323 Details available
MEDIUM (4.3)
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Published: 2025-11-30T00:00:00.000Z
Updated: 2025-12-01T14:10:40.069Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-26662 vulnerable 2026-06-08 05:41:52.777973 Details available
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
Published: 2022-03-07T22:40:00.000Z
Updated: 2024-08-03T05:11:44.228Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-26661 vulnerable 2026-06-08 05:41:52.777137 Details available
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
Published: 2022-03-07T22:40:11.000Z
Updated: 2024-08-03T05:11:44.600Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-37014 vulnerable 2026-06-08 05:25:50.007517 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-10868 vulnerable 2026-06-08 05:12:25.357033 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-0861 vulnerable 2026-06-08 05:06:24.109690 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-2238 vulnerable 2026-06-08 05:02:02.856971 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-0215 vulnerable 2026-06-08 05:00:40.043461 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.