epicor records
5 published records for vendor epicor.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2025-22953Proof of concept | A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57epicor · human capital management · CWE-89 | Critical9.8 | — | 1.8% | Mar 28, 2025 |
31Monitor | CVE-2014-4313No exploit | SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User fielepicor · epicor procurement · CWE-89 | High7.5 | — | 2.1% | Oct 10, 2014 |
31Monitor | CVE-2015-2210No exploit | The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into thepicor · crs retail store · CWE-77 | High7.8 | — | 0.6% | Sep 6, 2017 |
22Monitor | CVE-2014-4311Proof of concept | Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mail Connection passworepicor · epicor enterprise · CWE-200 | Medium5.0 | — | 5.7% | Nov 3, 2014 |
18Monitor | CVE-2014-4312Proof of concept | Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject epicor · epicor enterprise · CWE-79 | Medium4.3 | — | 4.1% | Oct 10, 2014 |
- CVE-2025-2295340Plan
A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57
CriticalCVSS 9.8Proof of conceptEPSS 1%epicor · human capital managementMar 28, 2025
- CVE-2014-431331Monitor
SQL injection vulnerability in Epicor Procurement before 7.4 SP2 allows remote attackers to execute arbitrary SQL commands via the User fiel
HighCVSS 7.5No exploitEPSS 2%epicor · epicor procurementOct 10, 2014
- CVE-2015-221031Monitor
The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into th
HighCVSS 7.8No exploitEPSS 0%epicor · crs retail storeSep 6, 2017
- CVE-2014-431122Monitor
Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mail Connection passwor
MediumCVSS 5.0Proof of conceptEPSS 5%epicor · epicor enterpriseNov 3, 2014
- CVE-2014-431218Monitor
Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject
MediumCVSS 4.3Proof of conceptEPSS 4%epicor · epicor enterpriseOct 10, 2014