Sage
Monthly
Privilege escalation in Sage AR Automation (the 'Cash Collect' product) before the June-R1-2026 release allows an authenticated low-privileged user to create administrator accounts through the AR Automation API, because administrative functions fail to enforce privilege checks. Any user with a valid low-level login can promote themselves to full administrative control of the application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-tenant privilege escalation in Sage AR Automation (the 'Cash Collect' service) lets an authenticated tenant user reach administrative resources belonging to other tenants by supplying a valid tenant identifier that the API fails to authorize against the caller. Because the identifier is non-predictable, exploitation requires first obtaining a legitimate foreign tenant ID, which raises attack complexity but still breaks the multi-tenant isolation boundary of this SaaS platform. Reported via HackerOne; no public exploit code or active exploitation has been identified at time of analysis.
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthenticated remote attackers. The flaw stems from insufficient sanitization of file path parameters, allowing directory traversal sequences and their URL-encoded equivalents to escape the application's intended filesystem scope and read sensitive data such as configuration files, environment settings, and logs. No public exploit or CISA KEV listing is present; Sage has remediated the issue via enhanced path validation shipped in the Q2 2026 HRMS product update.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A file disclosure vulnerability exists in Sage 1000 v7.0.0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in Sage AR Automation (the 'Cash Collect' product) before the June-R1-2026 release allows an authenticated low-privileged user to create administrator accounts through the AR Automation API, because administrative functions fail to enforce privilege checks. Any user with a valid low-level login can promote themselves to full administrative control of the application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-tenant privilege escalation in Sage AR Automation (the 'Cash Collect' service) lets an authenticated tenant user reach administrative resources belonging to other tenants by supplying a valid tenant identifier that the API fails to authorize against the caller. Because the identifier is non-predictable, exploitation requires first obtaining a legitimate foreign tenant ID, which raises attack complexity but still breaks the multi-tenant isolation boundary of this SaaS platform. Reported via HackerOne; no public exploit code or active exploitation has been identified at time of analysis.
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthenticated remote attackers. The flaw stems from insufficient sanitization of file path parameters, allowing directory traversal sequences and their URL-encoded equivalents to escape the application's intended filesystem scope and read sensitive data such as configuration files, environment settings, and logs. No public exploit or CISA KEV listing is present; Sage has remediated the issue via enhanced path validation shipped in the Q2 2026 HRMS product update.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A file disclosure vulnerability exists in Sage 1000 v7.0.0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.