Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,804 results · page 19 of 37
Aug 29, 2024A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in thCVE-2024-44777 · Other software · vtiger · reported by MITRECritical 9.6
A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
- Product
- vtiger_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.com
Aug 29, 2024An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.CVE-2024-44776 · Other software · Vtiger · reported by MITREMedium 6.1
An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.com
Aug 18, 2024Propovoice CRM: Authorization Bypass Through User-Controlled KeyCVE-2024-43350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Propovoice Propovoice CRM.This issue affects Propovoice CRM: from n/a through 1.7.6.4.
- Product
- Propovoice CRM
- Affected
- up to 1.7.6.4
- What to do
- Affects up to 1.7.6.4. Update Propovoice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2024VTiger CRM <= 8.1.0 does not correctly check user privileges.CVE-2024-42995 · Other software · vtiger · reported by MITREHigh 8.3
VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules.
- Product
- vtiger_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of thCVE-2024-42994 · Other software · vtiger · reported by MITREHigh 7.2
VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module.
- Product
- vtiger_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests.CVE-2024-41737 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.
- Product
- SAP CRM ABAP (Insights Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privilCVE-2024-41309 · Other software · enjay · reported by MITREHigh 7.8
An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthe-it-wonders.blogspot.com
Aug 7, 2024An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on CVE-2024-41308 · Other software · enjay · reported by MITREHigh 7.8
An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthe-it-wonders.blogspot.com
Aug 6, 2024An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by trickinCVE-2024-38166 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.
- Product
- Dynamics CRM Service Portal Web Resource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024CRM Perks Forms: Arbitrary file uploadsCVE-2024-7484 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- CRM Perks Forms
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2024A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072.CVE-2024-40531 · Other software · uab_lexita · reported by MITREHigh 8.8
A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, including roles, by injecting additional parameters via profile management functions.
- Product
- panteracrm_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-ForCVE-2024-40530 · Other software · uab_lexita · reported by MITREHigh 7.5
A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header.
- Product
- panteracrm_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024ChurchCRM is an open-source church management system.CVE-2024-39304 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQL statements directly into the database query due to inadequate sanitization of the EID parameter in in a GET request to `/GetText.php`. Version 5.9.2 patches the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users ModCVE-2024-40137 · Other software · dolibarr · reported by MITREMedium 5.5
Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function.
- Product
- dolibarr_erp\/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.CVE-2024-6944 · Other software · ZhongBangKeJi · reported by VulDBMedium 5.3
A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jul 21, 2024A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.CVE-2024-6943 · Other software · ZhongBangKeJi · reported by VulDBMedium 5.3
A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272065 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jul 20, 2024Zoho CRM Lead Magnet: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38696 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zoho CRM Zoho CRM Lead Magnet allows Reflected XSS.This issue affects Zoho CRM Lead Magnet: from n/a through 1.7.8.8.
- Product
- Zoho CRM Lead Magnet
- Affected
- up to 1.7.8.8
- What to do
- Affects up to 1.7.8.8. Update Zoho CRM Lead Magnet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 9, 2024Houzez CRM: Time-based SQL InjectionCVE-2024-5792 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belong_to’ parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Houzez CRM
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Houzez CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfavethemes.zendesk.comwordfence.com
Jul 9, 2024SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges.CVE-2024-37175 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to access some sensitive information.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requCVE-2024-39598 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability.CVE-2024-37174 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script.CVE-2024-37173 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code IncCVE-2024-5683 · Other software · Next4Biz CRM & BPM Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code Inclusion. This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.
- Product
- Business Process Manangement (BPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jun 24, 2024Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (CVE-2024-4754 · Other software · Next4Biz CRM & BPM Software · reported by iletisim@usom.gov.trMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Stored XSS. This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.
- Product
- Business Process Manangement (BPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jun 18, 2024An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploadinCVE-2024-37821 · Other software · dolibarr · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
- Product
- dolibarr_erp\/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected CVE-2024-36647 · Other software · churchcrm · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page.
- Product
- churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script.CVE-2024-34686 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36419 · Other software · salesagility · reported by GitHubMedium 4.3
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the `/legacy` route. Version 8.6.1 contains a patch for the issue.
- Product
- SuiteCRM-Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36418 · Other software · salesagility · reported by GitHubHigh 8.5
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allows an authenticated user to perform a remote code execution attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36417 · Other software · salesagility · reported by GitHubMedium 5.7
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36416 · Other software · salesagility · reported by GitHubHigh 8.6
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36415 · Other software · salesagility · reported by GitHubCritical 9.1
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36414 · Other software · salesagility · reported by GitHubHigh 7.7
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors file verification allows for a server-side request forgery attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36413 · Other software · salesagility · reported by GitHubHigh 8.9
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import module error view allows for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36412 · Other software · salesagility · reported by GitHubCritical 10
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36411 · Other software · salesagility · reported by GitHubCritical 9.6
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax displayView controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36410 · Other software · salesagility · reported by GitHubCritical 9.6
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36409 · Other software · salesagility · reported by GitHubCritical 9.6
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36408 · Other software · salesagility · reported by GitHubCritical 9.6
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in the `Alerts` controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36407 · Other software · salesagility · reported by GitHubLow 3.7
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024SuiteCRM is an open-source Customer Relationship Management (CRM) software application.CVE-2024-36406 · Other software · salesagility · reported by GitHubMedium 5.4
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open re-direct. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2024SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.pCVE-2024-36837 · Other software · crmeb · reported by MITREHigh 7.5
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.
- Product
- crmeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2024Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection.CVE-2024-5315 · Other software · Dolibarr · reported by cve-coordination@incibe.esCritical 9.1
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in /dolibarr/commande/list.php.
- Product
- ERP CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2024Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection.CVE-2024-5314 · Other software · Dolibarr · reported by cve-coordination@incibe.esCritical 9.1
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.
- Product
- ERP CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Propovoice CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4747 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Propovoice Propovoice CRM allows Stored XSS.This issue affects Propovoice CRM: from n/a through 1.7.6.2.
- Product
- Propovoice CRM
- Affected
- up to 1.7.6.2
- What to do
- Affects up to 1.7.6.2. Update Propovoice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 6, 2024crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController.CVE-2024-33117 · Other software · Crmeb · reported by MITREMedium 5.3
crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController.
- Product
- Crmeb Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Time-based SQL InjectionCVE-2024-1173 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with accounting manager or admin access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
- Affected
- up to 1.13.1
- What to do
- Affects up to 1.13.1. Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 30, 2024modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows themCVE-2023-46304 · Other software · vtiger · reported by MITREHigh 8.1
modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).
- Product
- vtiger_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.vtiger.comcode.vtiger.com
Apr 16, 2024Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protectiCVE-2024-31503 · Other software · dolibarr · reported by MITREHigh 7.5
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
- Product
- dolibarr_erp\/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2024-21086 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.