Erp Optima
Approved changes feed: RSS · Atom
cpe:2.3:a:comarch:erp_optima:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Comarch (a03d1097-f057-53d8-9e64-bea1cfe736e2) |
|---|---|
| Product | Erp Optima (d4bf80ab-83d4-582d-8777-82916ff81e75) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-68421 |
vulnerable | 2026-06-08 07:41:21.105442 |
Hardcoded credentials in Comarch ERP Optima
Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server.
This issue has been fixed in version 2026.4
Published: 2026-05-14T10:35:04.752Z
Updated: 2026-05-14T17:55:30.537Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68420 |
vulnerable | 2026-06-08 07:41:21.105058 |
Privilege Escalation in Comarch ERP Optima
Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configured, but a user does not have to be logged in.
This issue has been fixed in version 2026.4
Published: 2026-05-14T10:35:07.299Z
Updated: 2026-05-14T15:29:13.663Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.