Sage

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Sage product.

RSS Feeds for Sage security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Sage products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Sage Sorted by Most Security Vulnerabilities since 2018

Sage 3007 vulnerabilities

Sage Frp 10004 vulnerabilities

Sage Xrt Business Exchange2 vulnerabilities

Sage X32 vulnerabilities

Sage Easypay1 vulnerability

Sage 200 Spain1 vulnerability

Sage Enterprise Intelligence1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in Sage. Sage did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	3	0.00
2023	13	7.68
2022	1	7.80
2021	4	6.35
2020	1	5.40

It may take a day or so for new Sage vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Sage Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-48646	Oct 30, 2024	Sage 1000 v7.0.0 Unrestricted File Upload (CVE202448646) An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files, such as HTML, scripts, or other executable content, that may be executed on the server, leading to further system compromise.	Sage Frp 1000
CVE-2024-48647	Oct 30, 2024	Sage 1000 v7.0.0: File Disclosure via URL Param A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file system by manipulating the URL parameter in HTTP requests. The attacker can exploit this flaw to access sensitive information, including configuration files that may contain credentials and system settings, which could lead to further compromise of the server.	Sage Frp 1000
CVE-2024-48648	Oct 30, 2024	Sage 1000 v7.0.0 Reflected XSS via URL A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. This vulnerability allows attackers to inject malicious scripts into URLs, which are reflected back by the server in the response without proper sanitization or encoding.	Sage Frp 1000
CVE-2023-2809	Oct 04, 2023	Plaintext Credentials Leak in Sage 200 Spain 2023.38.001 DLL Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to known techniques to obtain remote execution of MS SQL commands and escalate privileges on Windows systems because the credentials are stored in plaintext.	Sage 200 Spain
CVE-2023-31868	Jun 22, 2023	Sage X3 12.14.0.50-0 XSS Vulnerability Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is injected into those fields, this code will be saved by the application and executed by the web browser of the user viewing the web page. Several injection points have been identified on the application. The major one requires the user to be authenticated with a common account, he can then target an Administrator. All others endpoints need the malicious user to be authenticated as an Administrator. Therefore, the impact is diminished.	X3
CVE-2023-31867	Jun 22, 2023	Sage X3 12.14 CSV Injection Vulnerability Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.	X3
CVE-2023-29927	May 16, 2023	Sage 300 Clientside RBAC Bypass via SQL Connection Retrieval Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the programs role-based access controls.	Sage 300
CVE-2022-41400	Apr 28, 2023	CVE-2022-41400: Sage 300 Hard-Coded Blowfish Key Exposes Passwords Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings.	Sage 300
CVE-2022-41399	Apr 28, 2023	Sage 300 DB config Blowfish Key Hardcoding Allows Unauth DB Access The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers to obtain access to the SQL database.	Sage 300
CVE-2022-41398	Apr 28, 2023	Sage 300 Hard-Coded Apache Solr Credentials (CVE-2022-41398) The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information.	Sage 300
CVE-2022-41397	Apr 28, 2023	HardCoded BF Key in Sage 300 Web Screens/Global Search The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and decrypt secrets stored in configuration files and in database tables.	Sage 300
CVE-2022-38583	Apr 28, 2023	Sage_300 6.46.9: Low-Priv Workstation User Can Modify SharedData to Impersonate SQL On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.	Sage 300
CVE-2019-25053	Jan 27, 2023	Remote Path Traversal in Sage FRP 1000 A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL.	Sage Frp 1000
CVE-2022-34323	Jan 01, 2023	Sage XRT BE 12.4.302 Stored XSS in Filters, Display & Notification Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Filters and Display model features (OnlineBanking > Web Monitoring > Settings > Filters / Display models). The name of a filter or a display model is interpreted as HTML and can thus embed JavaScript code, which is executed when displayed. This is a stored XSS. Another issue is present in the Notification feature (OnlineBanking > Configuration > Notifications and alerts > Alerts *). The name of an alert is interpreted as HTML, and can thus embed JavaScript code, which is executed when displayed. This is a stored XSS. (Also, an issue is present in the File download feature, accessible via /OnlineBanking/cgi/isapi.dll/DOWNLOADFRS. When requesting to show the list of downloadable files, the contents of three form fields are embedded in the JavaScript code without prior sanitization. This is essentially a self-XSS.)	Sage Xrt Business Exchange
CVE-2022-34322	Jan 01, 2023	Stored XSS in Sage Enterprise Intelligence 2021 R1.1 Notifications Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Notify Users About Modification menu and the Notifications feature. A user can send malicious notifications and execute JavaScript code in the browser of every user who has enabled notifications. This is a stored XSS, and can lead to privilege escalation in the context of the application. (Another issue is present in the Favorites tab. The name of a favorite or a folder of favorites is interpreted as HTML, and can thus embed JavaScript code, which is executed when displayed. This is a self-XSS.)	Sage Enterprise Intelligence
CVE-2022-34324	Jan 01, 2023	SQLi in Sage XRT Business Exchange 12.4.302 via Authenticated Access Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment Order, and Transfer History.	Sage Xrt Business Exchange
CVE-2021-45492	Jul 14, 2022	In Sage 300 ERP (formerly accpac) through 6.8.x In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions and therefore inherits weak permissions from the C:\ folder. Because entries in the system-wide PATH variable are included in the search order for DLLs, an attacker could perform DLL search-order hijacking to escalate their privileges to SYSTEM. Furthermore, if the Global Search or Web Screens functionality is enabled, then privilege escalation is possible via the GlobalSearchService and Sage.CNA.WindowsService services, again via DLL search-order hijacking because unprivileged users would have modify permissions on the application directory. Note that while older versions of the software default to installing in %PROGRAMFILES(X86)% (which would allow the Sage folder to inherit strong permissions, making the installation not vulnerable), the official Sage 300 installation guides for those versions recommend installing in C:\Sage, which would make the installation vulnerable.	Sage 300
CVE-2020-7387	Jul 22, 2021	Sage X3 Installation Pathname Disclosure Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Payroll Version 9 (those components that ship with Syracuse 9.24.1.3), Version 11 (components shipped with Syracuse 11.25.2.6 and later), and Version 12 (components shipped with Syracuse 12.10.2.8 and later) of Sage X3. Other on-premises versions of Sage X3 are unsupported by the vendor.
CVE-2020-7388	Jul 22, 2021	Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by exploiting CVE-2020-7387. This issue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 including Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Payroll Version 9 (those components that ship with Syracuse 9.24.1.3), Version 11 (components shipped with Syracuse 11.25.2.6 and later), and Version 12 (components shipped with Syracuse 12.10.2.8 and later) of Sage X3. Other on-premises versions of Sage X3 are unsupported by the vendor.
CVE-2020-7389	Jul 22, 2021	Sage X3 System CHAINE Variable Script Command Injection Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.
CVE-2020-7390	Jul 22, 2021	Sage X3 Stored XSS Vulnerability on Edit Page of User Profile Sage X3 Stored XSS Vulnerability on Edit Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor.
CVE-2020-13893	Oct 18, 2020	Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations (Best-fit Mapping), as demonstrated by the full-width variants of the less-than sign (%EF%BC%9C) and greater-than sign (%EF%BC%9E).	Easypay