Infor vulnerabilities

Products

• enterprise asset management 2
• eclient 1
• enspire distribution management solution 1
• global human resources 1
• SyteLine ERP 1

Latest Infor CVEs

Newest publication first

1. CVE-2026-2103 Use of Hard-Coded Cryptographic Key for Password Storage

   Published 2026-02-06

   High·CVSS 7.8 EPSS 0.11%

   Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection strings, and API keys. The encryption keys are identical across all installations. An attacker with access to the application binary and datab...

2. CVE-2024-51423 Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter.

   Published 2025-09-02

   Medium·CVSS 6.1 EPSS 0.32%

   Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter.

3. CVE-2017-7953 INFOR EAM V11.0 Build 201410 has XSS via comment fields.

   Published 2017-05-16

   Medium·CVSS 5.4 EPSS 0.95% Public exploit

   INFOR EAM V11.0 Build 201410 has XSS via comment fields.

4. CVE-2017-7952 INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter.

   Published 2017-05-16

   High·CVSS 8.8 EPSS 1.4% Public exploit

   INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter.

5. CVE-2011-1915 SQL injection vulnerability in eClient 7.3.2.3 in Enspire Distribution Management Solution 7.3.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

   Published 2011-11-01

   High·CVSS 7.5 EPSS 1.1%

   SQL injection vulnerability in eClient 7.3.2.3 in Enspire Distribution Management Solution 7.3.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.