Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,804 results · page 18 of 37
Jan 14, 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Arbitrary file uploadsCVE-2025-0394 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Affected
- up to 3.7.3.5
- What to do
- Affects up to 3.7.3.5. Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 10, 2025Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.CVE-2024-54687 · Other software · Vtiger · reported by MITREMedium 6.1
Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandrea0.medium.comandrea0.medium.com
Jan 7, 2025An issue was discovered in SuiteCRM 7.12.7.CVE-2022-45186 · Other software · Salesagility · reported by MITREHigh 8.1
An issue was discovered in SuiteCRM 7.12.7. Authenticated users can recover an arbitrary field of a database.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Jan 7, 2025An issue was discovered in SuiteCRM 7.12.7.CVE-2022-45185 · Other software · Salesagility · reported by MITREHigh 8.8
An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can be used to achieve code execution.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Jan 3, 2025An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uploaCVE-2024-55078 · Other software · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uploading a crafted file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 2, 2025Leads CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56027 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bizswoop Leads CRM leads-crm allows Reflected XSS.This issue affects Leads CRM: from n/a through <= 2.0.13.
- Product
- Leads CRM
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update Leads CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP-CRM System: Missing AuthorizationCVE-2024-55991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.2.9.1.
- Product
- WP-CRM System
- Affected
- up to 3.2.9.1
- What to do
- Affects up to 3.2.9.1. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2024CRM WordPress Plugin – RepairBuddy: Privilege escalationCVE-2024-12259 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The CRM WordPress Plugin – RepairBuddy plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.8120. This is due to the plugin not properly validating a user's identity prior to updating their email through the wc_update_user_data AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- CRM WordPress Plugin – RepairBuddy
- Affected
- up to 3.8120
- What to do
- Affects up to 3.8120. Update CRM WordPress Plugin – RepairBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2024CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout: Stored Cross-Site ScriptingCVE-2024-12443 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'crm-perks-tickets' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54258 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
- Product
- Ni CRM Lead
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54237 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
- Product
- Ni CRM Lead
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 22, 2024CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive informationCVE-2024-52726 · Other software · crmeb · reported by MITREHigh 7.5
CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information
- Product
- crmeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 22, 2024EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection.CVE-2024-53438 · Other software · churchcrm · reported by MITRECritical 9.8
EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.
- Product
- churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024Buying Buddy IDX CRM: Cross-Site Request Forgery (CSRF)CVE-2024-52446 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows Object Injection.This issue affects Buying Buddy IDX CRM: from n/a through <= 1.2.8.
- Product
- Buying Buddy IDX CRM
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Buying Buddy IDX CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Official SalesWizard CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51891 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SalesWizard.pl Official SalesWizard CRM Plugin official-saleswizard-crm allows Stored XSS.This issue affects Official SalesWizard CRM Plugin: from n/a through <= 1.0.3.
- Product
- Official SalesWizard CRM
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Official SalesWizard CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 15, 2024CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.CVE-2024-50653 · Other software · crmeb · reported by MITREHigh 7.5
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection.
- Product
- crmeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3.CVE-2024-11123 · Other software · 上海灵当信息科技有限公司 · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. This affects an unknown part of the file /crm/data/pdf.php. The manipulation of the argument url with the input ../config.inc.php leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3.CVE-2024-11122 · Other software · 上海灵当信息科技有限公司 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this issue is some unknown functionality of the file /crm/wechatSession/index.php?msgid=1&operation=upload. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability classified as critical was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3.CVE-2024-11121 · Other software · 上海灵当信息科技有限公司 · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this vulnerability is an unknown functionality of the file /crm/WeiXinApp/marketing/index.php?module=Users&action=getActionList. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024CRM 2go: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52350 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nrmendez CRM 2go crm2go allows DOM-Based XSS.This issue affects CRM 2go: from n/a through <= 1.0.
- Product
- CRM 2go
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CRM 2go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2024SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2024-50335 · Other software · salesagility · reported by GitHubMedium 4.9
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious JavaScript code. This can be exploited to steal CSRF tokens and perform unauthorized actions, such as creating new administrative users without proper authentication. The vulnerability arises due to insufficient input validation and sanitization of the Publish Key field within the SuiteCRM application. When an attacker injects a malicious script, it gets executed within the context of an authenticated user's session. The injected script (o.js) then leverages the captured CSRF token to forge requests that create new administrative users, effectively compromising the integrity and security of the CRM instance. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2024-50333 · Other software · salesagility · reported by GitHubMedium 6.6
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels() function can be used to write attacker-controlled data into the custom language file that will be included at the runtime. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2024-50332 · Other software · salesagility · reported by GitHubHigh 8.8
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL injection in DeleteRelationShip. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2024-49774 · Other software · salesagility · reported by GitHubHigh 7.2
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses token_get_all to parse PHP scripts and check the resulted AST against blacklists. But it doesn't take into account all scenarios. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2024-49773 · Other software · salesagility · reported by GitHubMedium 5.3
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. `current_post` parameter in `export` entry point can be abused to perform blind SQL injection via generateSearchWhere(). Allows for Information disclosure, including personally identifiable information. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2024-49772 · Other software · salesagility · reported by GitHubHigh 8.8
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation allows authenticated user do a SQL injection attack. Authenticated user with low pivilege can leak all data in database. This issue has been addressed in releases 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024CRM Perks Forms: Missing AuthorizationCVE-2024-37463 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CRM Perks CRM Perks Forms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CRM Perks Forms: from n/a through 1.1.5.
- Product
- CRM Perks Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Zoho CRM Lead Magnet: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49297 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows SQL Injection.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.7.9.7.
- Product
- Zoho CRM Lead Magnet
- Affected
- up to 1.7.9.7
- What to do
- Affects up to 1.7.9.7. Update Zoho CRM Lead Magnet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Contact Forms, Live Support, CRM, Video Messages: Insertion of Sensitive Information Into Sent DataCVE-2024-49235 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Retrieve Embedded Sensitive Data.This issue affects Contact Forms, Live Support, CRM, Video Messages: from n/a through <= 1.10.2.
- Product
- Contact Forms, Live Support, CRM, Video Messages
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update Contact Forms, Live Support, CRM, Video Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2024X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module.CVE-2024-48120 · Other software · x2engine · reported by MITREMedium 5.4
X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating a list.
- Product
- x2crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter.CVE-2024-48119 · Other software · vtiger · reported by MITREMedium 5.4
Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML.
- Product
- vtiger_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2024A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0.CVE-2024-9904 · Other software · zero_takeoff · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
- Product
- 07flycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2024A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0.CVE-2024-9903 · Other software · zero_takeoff · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
- Product
- 07flycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8.CVE-2024-9856 · Other software · 07fly · reported by VulDBMedium 5.1
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been rated as problematic. Affected by this issue is some unknown functionality of the component System Settings Page. The manipulation of the argument Login Interface Copyright leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
- Product
- 07fly-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8.CVE-2024-9855 · Other software · 07fly · reported by VulDBMedium 5.1
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadFile of the file /admin/SysModule/upload/ajaxmodel/upload/uploadfilepath/sysmodule_1 of the component Module Plug-In Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
- Product
- 07fly-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the wCVE-2024-42831 · Other software · elaine · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the web browser of a user via injecting a crafted payload into the dialog parameter at wrapper_dialog.php.
- Product
- marketing_automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Oct 7, 2024Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.CVE-2024-45932 · Other software · webkul · reported by MITREMedium 4.8
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.
- Product
- krayin_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024IDURAR is open source ERP CRM accounting invoicing software.CVE-2024-47769 · Other software · idurar · reported by GitHubHigh 7.5
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location.
- Product
- idurar-erp-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicioCVE-2024-46367 · Other software · webkul · reported by MITRECritical 9.6
A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.
- Product
- krayin_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecCVE-2024-46366 · Other software · webkul · reported by MITREHigh 8.8
A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.
- Product
- krayin_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3.CVE-2024-9278 · Other software · HuankeMao · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verification_file of the file WxkConfig.php of the component Administrator Backend. The manipulation of the argument domain_verification_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- SCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2024A vulnerability, which was classified as problematic, has been found in CodeCanyon CRMGo SaaS up to 7.2.CVE-2024-9031 · Other software · CodeCanyon · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in CodeCanyon CRMGo SaaS up to 7.2. This issue affects some unknown processing of the file /project/task/{task_id}/show. The manipulation of the argument comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CRMGo SaaS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2024A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2.CVE-2024-9030 · Other software · CodeCanyon · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The manipulation of the argument notes leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CRMGo SaaS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2024A vulnerability was found in Perfex CRM 3.1.6.CVE-2024-8867 · Other software · Perfex · reported by VulDBMedium 5.3
A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers/Clients.php of the component Parameter Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web scripts or HTML via aCVE-2024-44851 · Other software · perfexcrm · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter.
- Product
- perfex_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 10, 2024Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker toCVE-2024-45279 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker to craft a URL link which could embed a malicious JavaScript. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024SuiteCRM is an open-source customer relationship management (CRM) system.CVE-2024-45392 · Other software · salesagility · reported by GitHubHigh 7.7
SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 30, 2024HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics: Stored Cross-Site ScriptingCVE-2024-5879 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics
- Affected
- up to 11.1.22
- What to do
- Affects up to 11.1.22. Update HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code CVE-2024-44779 · Other software · vtiger · reported by MITRECritical 9.6
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
- Product
- vtiger_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.com
Aug 29, 2024A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code inCVE-2024-44778 · Other software · vtiger · reported by MITRECritical 9.6
A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
- Product
- vtiger_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.