Vtiger vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-23698 Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackHigh 8.6 · Jul 7, 2026
• CVE-2026-23697 Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phHigh 8.7 · Jul 7, 2026
• CVE-2025-45753 A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import funHigh 7.2 · May 21, 2025
• CVE-2024-44779 A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code Critical 9.6 · Aug 29, 2024
• CVE-2024-44778 A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code inCritical 9.6 · Aug 29, 2024
• CVE-2024-44777 A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in thCritical 9.6 · Aug 29, 2024
• CVE-2024-42995 VTiger CRM <= 8.1.0 does not correctly check user privileges.High 8.3 · Aug 16, 2024
• CVE-2024-42994 VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of thHigh 7.2 · Aug 16, 2024
• CVE-2023-46304 modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows themHigh 8.1 · Apr 30, 2024
• CVE-2023-38891 SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRuHigh 8.8 · Sep 14, 2023
• CVE-2020-22807 An issue was dicovered in vtiger crm 7.2.Critical 9.8 · Apr 29, 2021
• CVE-2015-6000 Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in VtigeHigh 8.8 · Feb 6, 2020
• CVE-2013-3215 vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.Critical 9.8 · Jan 29, 2020
• CVE-2013-3214 vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.Critical 9.8 · Jan 28, 2020
• CVE-2013-3212 vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local scHigh 8.1 · Jan 28, 2020
• CVE-2019-19202 In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 tHigh 8.8 · Nov 21, 2019
• CVE-2016-10754 modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter.High 8.8 · May 24, 2019
• CVE-2019-11057 SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands.High 8.8 · May 17, 2019
• CVE-2019-5009 Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size High 7.2 · Jan 4, 2019
• CVE-2016-1713 Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in VtigeHigh 7.3 · Apr 14, 2017
• CVE-2016-4834 modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create oHigh 8.1 · Jul 31, 2016
• CVE-2013-3213 Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name paraHigh 7.5 · Apr 2, 2014
• CVE-2011-4559 SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuserHigh 7.5 · Nov 28, 2011
• CVE-2009-3258 vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete (1) attachments, (2) reports, (3) filters, (4) views, and (5)High 9 · Sep 18, 2009
• CVE-2009-3250 The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composHigh 9 · Sep 18, 2009