# cve.now: Odoo The newest entries naming Odoo as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2024-36259](https://cve.now/CVE-2024-36259.md): Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sens (CVSS 7.5) - [CVE-2024-12368](https://cve.now/CVE-2024-12368.md): Improper access control in the auth\_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth (CVSS 8.1) - [CVE-2021-23203](https://cve.now/CVE-2021-23203.md): Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attack (CVSS 7.5) - [CVE-2021-44547](https://cve.now/CVE-2021-44547.md): A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading t (CVSS 8.7) - [CVE-2021-26947](https://cve.now/CVE-2021-26947.md): Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arb (CVSS 6.5) - [CVE-2021-26263](https://cve.now/CVE-2021-26263.md): Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote at (CVSS 7.5) - [CVE-2021-44465](https://cve.now/CVE-2021-44465.md): Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe (CVSS 5.3) - [CVE-2021-44775](https://cve.now/CVE-2021-44775.md): Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attac (CVSS 6.5) - [CVE-2021-23178](https://cve.now/CVE-2021-23178.md): Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments (CVSS 7.5) - [CVE-2021-23186](https://cve.now/CVE-2021-23186.md): A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and (CVSS 8.7) - [CVE-2021-23166](https://cve.now/CVE-2021-23166.md): A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and w (CVSS 8.7) - [CVE-2021-44461](https://cve.now/CVE-2021-44461.md): Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the (CVSS 6.5) - [CVE-2021-44460](https://cve.now/CVE-2021-44460.md): Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to ac (CVSS 7.4) - [CVE-2021-44476](https://cve.now/CVE-2021-44476.md): A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local (CVSS 6.8) - [CVE-2021-45111](https://cve.now/CVE-2021-45111.md): Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger (CVSS 7.1) - [CVE-2021-23176](https://cve.now/CVE-2021-23176.md): Improper access control in reporting engine of l10n\_fr\_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier al (CVSS 6.5) - [CVE-2021-45071](https://cve.now/CVE-2021-45071.md): Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arb (CVSS 5.3) - [CVE-2020-29396](https://cve.now/CVE-2020-29396.md): A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows (CVSS 9.9) - [CVE-2019-11786](https://cve.now/CVE-2019-11786.md): Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify (CVSS 4.3) - [CVE-2019-11785](https://cve.now/CVE-2019-11785.md): Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote au (CVSS 6.5) - [CVE-2019-11784](https://cve.now/CVE-2019-11784.md): Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remot (CVSS 6.5) - [CVE-2019-11783](https://cve.now/CVE-2019-11783.md): Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows re (CVSS 6.5) - [CVE-2019-11782](https://cve.now/CVE-2019-11782.md): Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with acce (CVSS 6.5) - [CVE-2019-11781](https://cve.now/CVE-2019-11781.md): Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attacke (CVSS 6.5) - [CVE-2018-15645](https://cve.now/CVE-2018-15645.md): Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticat (CVSS 8.1) - [CVE-2018-15641](https://cve.now/CVE-2018-15641.md): Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote auth (CVSS 6.3) - [CVE-2018-15638](https://cve.now/CVE-2018-15638.md): Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attac (CVSS 7.1) - [CVE-2018-15634](https://cve.now/CVE-2018-15634.md): Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows re (CVSS 7.1) - [CVE-2018-15633](https://cve.now/CVE-2018-15633.md): Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote (CVSS 7.1) - [CVE-2018-15632](https://cve.now/CVE-2018-15632.md): Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote (CVSS 8.2) - [CVE-2019-11780](https://cve.now/CVE-2019-11780.md): Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authent (CVSS 8.1) - [CVE-2018-15640](https://cve.now/CVE-2018-15640.md): Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated pr (CVSS 8.1) - [CVE-2018-15635](https://cve.now/CVE-2018-15635.md): Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote (CVSS 5.9) - [CVE-2018-15631](https://cve.now/CVE-2018-15631.md): Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authentica (CVSS 6.5) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/odoo Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.