Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,807 results · page 22 of 37
Jul 18, 2023A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0.CVE-2023-3754 · Other software · Creativeitem · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0. Affected is an unknown function of the file /index.php/client/message/message_read/xxxxxxxx[random-msg-hash]. The manipulation of the argument message leads to cross site scripting. It is possible to launch the attack remotely. VDB-234426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ekushey Project Manager CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.CVE-2023-3627 · Other software · salesagility · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.
- Product
- salesagility/suitecrm-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic.CVE-2023-3562 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233356. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP CRM Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729.CVE-2023-3529 · Other software · Rotem Dynamics · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=[ID][ampersand]method=sms of the component OTP URI Interface. The manipulation leads to information exposure through discrepancy. It is possible to initiate the attack remotely. The identifier VDB-233253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Rotem CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2023A vulnerability was found in Onest CRM 1.0.CVE-2023-3505 · Other software · Onest · reported by VulDBLow 3.5
A vulnerability was found in Onest CRM 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/project/update/2 of the component Project List Handler. The manipulation of the argument name with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-232953 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Cross-Site Request ForgeryCVE-2020-36735 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on the handle_leave_calendar_filter, add_enable_disable_option_save, leave_policies, process_bulk_action, and process_crm_contact functions. This makes it possible for unauthenticated attackers to modify the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 28, 2023Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parametersCVE-2023-33661 · Other software · Churchcrm · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023PHPgurukl Small CRM v.1.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-34650 · Other software · Small CRM Project · reported by MITREMedium 6.1
PHPgurukl Small CRM v.1.0 is vulnerable to Cross Site Scripting (XSS).
- Product
- Small CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Jun 27, 2023Catalyst Connect Zoho CRM Client Portal: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2023-0588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
- Product
- Catalyst Connect Zoho CRM Client Portal
- Fixed in
- 2.1.0
- What to do
- Update Catalyst Connect Zoho CRM Client Portal to 2.1.0 or newer.
Jun 19, 2023Integration for Contact Form 7 and Zoho CRM, Bigin: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2527 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Integration for Contact Form 7 and Zoho CRM, Bigin
- Fixed in
- 1.2.4
- What to do
- Update Integration for Contact Form 7 and Zoho CRM, Bigin to 1.2.4 or newer.
Jun 17, 2023An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.CVE-2023-35811 · Other software · Sugarcrm · reported by MITREHigh 8.8
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be injected through the REST API because of missing input validation. Regular user privileges can use used for exploitation. Editions other than Enterprise are also affected.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 17, 2023An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.CVE-2023-35810 · Other software · Sugarcrm · reported by MITREHigh 7.2
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has been identified in the DocuSign module. By using crafted requests, custom PHP code can be injected and executed through the DocuSign module because of missing input validation. Admin user privileges are required to exploit this vulnerability. Editions other than Enterprise are also affected.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 17, 2023An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.CVE-2023-35809 · Other software · Sugarcrm · reported by MITREHigh 8.8
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 17, 2023An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.CVE-2023-35808 · Other software · Sugarcrm · reported by MITREHigh 8.8
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using crafted requests, custom PHP code can be injected and executed through the Notes module because of missing input validation. Regular user privileges can be used to exploit this vulnerability. Editions other than Enterprise are also affected.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 16, 2023Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.CVE-2023-3293 · Other software · salesagility · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.
- Product
- salesagility/suitecrm-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability was found in Zhong Bang CRMEB up to 4.6.0.CVE-2023-3234 · Other software · Zhong Bang · reported by VulDBMedium 4.3
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been declared as problematic. Affected by this vulnerability is the function put_image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231505 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability was found in Zhong Bang CRMEB up to 4.6.0.CVE-2023-3233 · Other software · Zhong Bang · reported by VulDBMedium 6.3
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/controller/v1/PublicController.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231504. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical.CVE-2023-3232 · Other software · Zhong Bang · reported by VulDBMedium 6.3
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/app_auth of the component Image Upload. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231503. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliCVE-2023-33568 · Other software · Dolibarr · reported by MITREHigh 7.5
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site ScriptinCVE-2023-33986 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.
- Product
- SAP CRM ABAP (Grantor Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 9, 2023FluentCRM - Marketing Automation For WordPress: Unauthorized modification of dataCVE-2023-1430 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.
- Product
- FluentCRM - Marketing Automation For WordPress
- Affected
- up to 2.8.01
- What to do
- Affects up to 2.8.01. Update FluentCRM - Marketing Automation For WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jun 3, 2023CRM and Lead Management by vcita: Cross-Site Request ForgeryCVE-2023-2405 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- CRM and Lead Management by vcita
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
Jun 3, 2023CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2023-2404 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CRM and Lead Management by vcita
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
Jun 2, 2023A vulnerability was found in 07FLY CRM up to 1.2.0.CVE-2023-3058 · Other software · 07FLY · reported by VulDBLow 3.5
A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the component User Profile Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230560.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts orCVE-2023-31548 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.CVE-2023-26842 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023CRM Perks Forms: Stored Cross-Site ScriptingCVE-2023-2836 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- CRM Perks Forms
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
May 29, 2023Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.CVE-2023-30253 · Other software · Dolibarr · reported by MITREHigh 8.8
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4.CVE-2023-2925 · Other software · Webkul · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizations/edit/2 of the component Edit Person Page. The manipulation of the argument Organization leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230079. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- krayin crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.2.2 versions.CVE-2023-25976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 22, 2023Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second nameCVE-2023-25440 · Other software · Civicrm · reported by MITREMedium 5.4
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.
- Product
- Civicrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcivicrm.orgpacketstormsecurity.com
May 17, 2023ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.CVE-2023-31699 · Other software · Churchcrm · reported by MITREMedium 4.8
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.CVE-2023-27742 · Other software · Idurarapp · reported by MITRECritical 9.8
IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.
- Product
- Idurar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF CVE-2023-30742 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.An attacker could store a malicious URL and lure the victim to click, causing the script supplied by the attacker to execute in the victim user's session. The information from the victim's session could then be modified or read by the attacker.
- Product
- SAP CRM (WebClient UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 8, 2023SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 7CVE-2023-29188 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordi7p.wdf.sap.corpsap.com
May 7, 2023CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.CVE-2023-30185 · Other software · Crmeb · reported by MITRECritical 9.8
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.
- Product
- Crmeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.CVE-2023-29842 · Other software · Churchcrm · reported by MITREHigh 8.8
ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 28, 2023A vulnerability was found in Zhong Bang CRMEB 4.6.0.CVE-2023-2419 · Other software · Zhong Bang · reported by VulDBMedium 4.7
A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file \crmeb\app\services\system\attachment\SystemAttachmentServices.php. The manipulation of the argument filename leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227716.
- Product
- CRMEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.CVE-2023-26843 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently loggeCVE-2023-26841 · Other software · Churchcrm · reported by MITREMedium 6.5
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.CVE-2023-26840 · Other software · Churchcrm · reported by MITREMedium 5.3
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.CVE-2023-26839 · Other software · Churchcrm · reported by MITREMedium 4.3
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person.CVE-2023-25348 · Other software · Churchcrm · reported by MITREHigh 7.8
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields.CVE-2023-25347 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /CVE-2023-25346 · Other software · Churchcrm · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework).CVE-2023-21909 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework). Supported versions that are affected are 23.3 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- Siebel UI Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an indexCVE-2022-48178 · Other software · X2engine · reported by MITREMedium 5.4
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.
- Product
- X2crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsourceforge.net
Apr 14, 2023X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records CVE-2022-48177 · Other software · X2engine · reported by MITREMedium 5.4
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.
- Product
- X2crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsourceforge.net
Apr 11, 2023SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to CVE-2023-29189 · Network & remote access · SAP · reported by cna@sap.comMedium 5.4
SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields
- Product
- CRM (WebClient UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 10, 2023In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can uCVE-2023-27897 · Network & remote access · SAP · reported by cna@sap.comMedium 6
In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.