1. Mailing Lists
  2. Contributors
  3. Odoo Vulnerability Scanner (Security) – Seeking Ideas & Feedback

Contributors mailing list archives

contributors@odoo-community.org

Browse archives

report_py3o

Re: Peppol 2026 Belgium

Avatar

Odoo Vulnerability Scanner (Security) – Seeking Ideas & Feedback

by "Jerôme Dewandre" <jerome.dewandre.mail@gmail.com> - 28/03/2025 11:13:30

Hello,

I’m working on OdooScan, a project inspired by WPScan, designed to identify design flaws and security misconfigurations in Odoo instances:
🔗 https://github.com/cyberwave-odoo/odooscan

I’m looking for guidance and ideas to make this project more fun, and engaging for security professionals.

Current Features & Areas for Improvement:

✔️ Detecting the installed Odoo version and related vulnerabilities
✔️ Identifying vulnerable installed modules
✔️ Username enumeration
✔️ Weak password detection via brute force
✔️ Publicly accessible config files and database dumps
✔️ Exposed error logs
✔️ Media file enumeration
✔️ Checking if Odoo-Cron is enabled
✔️ Detecting open user registration

Future Enhancements:

🚀 Static Code Analysis – Identify vulnerabilities in custom Odoo modules
🚀 API Fuzzing – Test the robustness of exposed APIs

I’d love to hear your thoughts on improving OdooScan! Any feedback, suggestions, or feature ideas would be greatly appreciated.

Looking forward to your insights!

Kind regards,
Jérôme