Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,804 results · page 16 of 37
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54783 · Other software · SuiteCRM · reported by GitHubMedium 5.1
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but allow the JavaScript code to execute. This is fixed in version 7.14.7.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54788 · Other software · SuiteCRM · reported by GitHubHigh 8.8
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54786 · Other software · SuiteCRM · reported by GitHubMedium 5.3
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.
- Product
- SuiteCRM-Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54785 · Other software · SuiteCRM · reported by GitHubHigh 8.8
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 4, 2025EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP.CVE-2025-52892 · Other software · espocrm · reported by GitHubMedium 4.5
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7.CVE-2025-8345 · Other software · Shanghai Lingdang Information Technology · reported by VulDBLow 2.1
A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the function delete_user of the file crm/WeiXinApp/yunzhijia/yunzhijiaApi.php. The manipulation of the argument function leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5.2 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2025A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7.CVE-2025-8219 · Other software · Shanghai Lingdang Information Technology · reported by VulDBMedium 5.3
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. It has been rated as critical. This issue affects some unknown processing of the file /crm/crmapi/erp/tabdetail_moduleSave_dxkp.php of the component HTTP POST Request Handler. The manipulation of the argument getvaluestring leads to sql injection. The attack may be initiated remotely. Upgrading to version 8.6.5.2 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+. We strongly advise all customers to upgrade to the current version (v8.6.5.2), which includes this fix and additional security enhancements."
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2025-5240 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CRM and Lead Management by vcita
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 21, 2025EspoCRM is an Open Source CRM (Customer Relationship Management) software.CVE-2025-52575 · Other software · espocrm · reported by GitHubMedium 6.5
EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration. This was fixed in version 9.1.7.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in Chanjet CRM 1.0 and classified as critical.CVE-2025-7915 · Other software · Chanjet · reported by VulDBMedium 5.5
A vulnerability was found in Chanjet CRM 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /mail/mailinactive.php of the component Login Page. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical.CVE-2025-7880 · Other software · Metasoft 美特软件 · reported by VulDBLow 2.1
A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this issue is some unknown functionality of the file /business/common/sms/sendsms.jsp. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical.CVE-2025-7879 · Other software · Metasoft 美特软件 · reported by VulDBLow 2.1
A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mobileupload.jsp. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2.CVE-2025-7878 · Other software · Metasoft 美特软件 · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2. Affected is an unknown function of the file /common/jsp/upload2.jsp. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2.CVE-2025-7877 · Other software · Metasoft 美特软件 · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This issue affects some unknown processing of the file sendfile.jsp. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability classified as critical was found in Metasoft 美特软件 MetaCRM up to 6.4.2.CVE-2025-7876 · Other software · Metasoft 美特软件 · reported by VulDBLow 2.1
A vulnerability classified as critical was found in Metasoft 美特软件 MetaCRM up to 6.4.2. This vulnerability affects the function AnalyzeParam of the file download.jsp. The manipulation of the argument p leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2.CVE-2025-7875 · Other software · Metasoft 美特软件 · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2.CVE-2025-7874 · Other software · Metasoft 美特软件 · reported by VulDBMedium 5.5
A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /env.jsp. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2.CVE-2025-7873 · Other software · Metasoft 美特软件 · reported by VulDBLow 2.1
A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file mcc_login.jsp. The manipulation of the argument workerid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MetaCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability has been found in BossSoft CRM 6.0 and classified as critical.CVE-2025-7801 · Other software · BossSoft · reported by VulDBMedium 5.5
A vulnerability has been found in BossSoft CRM 6.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /crm/module/HNDCBas_customPrmSearchDtl.jsp. The manipulation of the argument cstid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: User Interface).CVE-2025-30758 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: User Interface). Supported versions that are affected are 25.0-25.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- Siebel CRM End User
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2025-30739 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.2.11-12.2.13. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. While the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data as well as unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N).
- Product
- Oracle CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.CVE-2024-58258 · Other software · SugarCRM · reported by MITREHigh 7.2
SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.
- Product
- SugarCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.sugarcrm.comseclists.org
Jul 6, 2025A vulnerability classified as problematic was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.3.9.CVE-2025-7078 · Other software · 07fly · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.3.9. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 07flycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025Lead Form Data Collection to CRM: Unauthorized accessCVE-2025-5692 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
- Product
- Lead Form Data Collection to CRM
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 29, 2025A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilCVE-2025-24289 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. The plugin is disabled by default.
- Product
- UCRM Client Signup Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection.CVE-2024-12150 · Other software · Eron Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection. This issue affects Wowwo CRM. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
- Product
- Wowwo CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jun 27, 2025WPCRM - CRM for Contact form CF7 & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24774 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows Reflected XSS.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
- Product
- WPCRM - CRM for Contact form CF7 & WooCommerce
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update WPCRM - CRM for Contact form CF7 & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2025A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2023-44915 · Other software · reported by MITREHigh 7.1
A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialCVE-2025-25034 · Other software · SugarCRM · reported by VulnCheckCritical 9.3
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
- Product
- SugarCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.comraw.githubusercontent.com
Jun 20, 2025Buying Buddy IDX CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50037 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows DOM-Based XSS.This issue affects Buying Buddy IDX CRM: from n/a through <= 2.3.0.
- Product
- Buying Buddy IDX CRM
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Buying Buddy IDX CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025CRM ERP Business Solution: Missing AuthorizationCVE-2025-49987 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CRM ERP Business Solution: from n/a through <= 1.13.
- Product
- CRM ERP Business Solution
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update CRM ERP Business Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Integration for Contact Form 7 and Zoho CRM, Bigin: Deserialization of Untrusted DataCVE-2025-49330 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through <= 1.3.0.
- Product
- Integration for Contact Form 7 and Zoho CRM, Bigin
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Integration for Contact Form 7 and Zoho CRM, Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025WPCRM - CRM for Contact form CF7 & WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows SQL Injection.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
- Product
- WPCRM - CRM for Contact form CF7 & WooCommerce
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update WPCRM - CRM for Contact form CF7 & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2025A vulnerability has been found in Chanjet CRM 1.0 and classified as critical.CVE-2025-6132 · Other software · Chanjet · reported by VulDBMedium 5.5
A vulnerability has been found in Chanjet CRM 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysconfig/departmentsetting.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability was found in WuKongOpenSource WukongCRM 9.0 and classified as problematic.CVE-2025-6106 · Other software · WuKongOpenSource · reported by VulDBLow 2.1
A vulnerability was found in WuKongOpenSource WukongCRM 9.0 and classified as problematic. This issue affects some unknown processing of the file AdminRoleController.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WukongCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability, which was classified as problematic, was found in WuKongOpenSource WukongCRM 9.0.CVE-2025-5879 · Other software · WuKongOpenSource · reported by VulDBLow 2
A vulnerability, which was classified as problematic, was found in WuKongOpenSource WukongCRM 9.0. This affects an unknown part of the file AdminSysConfigController.java of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WukongCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025WP-CRM System: Missing AuthorizationCVE-2025-49270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.
- Product
- WP-CRM System
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 3, 2025A vulnerability was found in WuKongOpenSource WukongCRM 9.0.CVE-2025-5521 · Other software · WuKongOpenSource · reported by VulDBMedium 5.3
A vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/user/updataPassword. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WukongCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability classified as critical was found in Chanjet CRM up to 20250510.CVE-2025-5152 · Other software · Chanjet · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Chanjet CRM up to 20250510. This vulnerability affects unknown code of the file /activity/newActivityedit.php?DontCheckLogin=1&id=null&ret=mod1. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Lead Form Data Collection to CRM: Missing AuthorizationCVE-2025-47690 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.
- Product
- Lead Form Data Collection to CRM
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Infocob CRM Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47513 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in James Laforge Infocob CRM Forms infocob-crm-forms allows Path Traversal.This issue affects Infocob CRM Forms: from n/a through <= 2.4.0.
- Product
- Infocob CRM Forms
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Infocob CRM Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2025A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import funCVE-2025-45753 · Other software · Vtiger · reported by MITREHigh 7.2
A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature.CVE-2025-45755 · Other software · Vtiger · reported by MITREMedium 6.1
A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped to the Service Name field. When the file is uploaded, the application improperly sanitizes user input, leading to persistent script execution.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsimonjuguna.comvtiger.com
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employeesCVE-2024-12812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
- Product
- WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
- Fixed in
- 1.13.4
- What to do
- Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Does not sanitise and escape some of its settingsCVE-2024-12808 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
- Fixed in
- 1.13.4
- What to do
- Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
May 12, 2025EspoCRM is a free, open-source customer relationship management platform.CVE-2025-32390 · Other software · espocrm · reported by GitHubHigh 7
EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to complete page defacement imitating the login page. Authenticated users with the read knowledge article privilege can browse to the KB article and if they submit their credentials, they get captured in plain text. The vulnerability is allowed by overly permissive HTML editing being allowed on the KB articles. Any authenticated user with the privilege to read KB articles is impacted. In an enterprise with multiple applications, the malicious KB article could be edited to match the login pages of other applications, which would make it useful for credential harvesting against other applications as well. Version 9.0.8 contains a patch for the issue.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A vulnerability was found in Changjietong UFIDA CRM 1.0.CVE-2025-4510 · Other software · Changjietong · reported by VulDBMedium 5.3
A vulnerability was found in Changjietong UFIDA CRM 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /optnty/optntyday.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- UFIDA CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Arbitrary file deletionCVE-2025-4206 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Affected
- up to 4.1.1.2
- What to do
- Affects up to 4.1.1.2. Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2025Integrations of Zoho CRM with Elementor form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47644 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form allows Phishing.This issue affects Integrations of Zoho CRM with Elementor form: from n/a through <= 1.0.8.
- Product
- Integrations of Zoho CRM with Elementor form
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Integrations of Zoho CRM with Elementor form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP-CRM System: Deserialization of Untrusted DataCVE-2025-47629 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through <= 3.4.5.
- Product
- WP-CRM System
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.