Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,807 results · page 23 of 37
Apr 10, 2023WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Fixed in
- 2.7.9.4
- What to do
- Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to 2.7.9.4 or newer.
Apr 3, 2023The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack CVE-2023-26855 · Other software · Churchcrm · reported by MITREHigh 7.5
The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YKM YKM CRM allows Reflected XSS.CVE-2023-1060 · Other software · YKM · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YKM YKM CRM allows Reflected XSS. This issue affects YKM CRM: before 23.03.30.
- Product
- YKM CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 23, 2023A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4.CVE-2023-1609 · Other software · Zhong Bang · reported by VulDBLow 3.5
A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/store/product/save. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223739.
- Product
- CRMEB Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4.CVE-2023-1608 · Other software · Zhong Bang · reported by VulDBMedium 6.3
A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223738 is the identifier assigned to this vulnerability.
- Product
- CRMEB Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafteCVE-2023-27059 · Other software · Churchcrm · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.CVE-2023-25223 · Other software · Crmeb · reported by MITREHigh 7.2
CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.
- Product
- Crmeb Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023A vulnerability was found in Zhong Bang CRMEB Java 1.3.4.CVE-2023-1165 · Other software · Zhong Bang · reported by VulDBMedium 5.5
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-222261 was assigned to this vulnerability.
- Product
- CRMEB Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.CVE-2023-1034 · Other software · salesagility · reported by security@huntr.devHigh 8.8
Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.
- Product
- salesagility/suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow mCVE-2023-24529 · Network & remote access · SAP · reported by cna@sap.comMedium 6.1
Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a Reflected Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to hijack a user session, read and modify some sensitive information.
- Product
- NetWeaver AS ABAP (Business Server Pages application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Feb 13, 2023SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XCVE-2023-24525 · Network & remote access · SAP · reported by cna@sap.comMedium 4.3
SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.
- Product
- CRM (WebClient UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Feb 9, 2023ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.CVE-2023-24690 · Other software · Churchcrm · reported by MITREMedium 5.4
ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iogithub.com
Feb 9, 2023An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.CVE-2023-24686 · Other software · Churchcrm · reported by MITREMedium 4.8
An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iogithub.com
Feb 9, 2023ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.CVE-2023-24685 · Other software · Churchcrm · reported by MITREHigh 7.2
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iopacketstormsecurity.com
Feb 9, 2023ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.CVE-2023-24684 · Other software · Churchcrm · reported by MITREHigh 7.2
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iogithub.com
Feb 6, 2023CRMEB 4.4.4 is vulnerable to Any File download.CVE-2022-44343 · Other software · Crmeb · reported by MITREHigh 7.5
CRMEB 4.4.4 is vulnerable to Any File download.
- Product
- Crmeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 2, 2023Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.CVE-2022-48082 · Other software · Easyone · reported by MITRECritical 9.8
Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
- Product
- Easyone CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted pCVE-2022-47073 · Other software · Small CRM Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter.
- Product
- Small CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.compacketstormsecurity.com
Jan 14, 2023Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.CVE-2022-38467 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 11, 2023Multiple SugarCRM Products Remote Code Execution VulnerabilityCVE-2023-22952 · Other software · SugarCRM · reported by MITREExploitedHigh 8.8
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
- Product
- Multiple Products
- On CISA’s list since
- Feb 2, 2023 (federal fix deadline Feb 23, 2023)
- What to do
- Attackers are using this now. Install SugarCRM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsupport.sugarcrm.com
Jan 10, 202372crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function.CVE-2022-46610 · Other software · 72crm · reported by MITREHigh 8.8
72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Wukong CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023Jetpack CRM: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4497 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins
- Product
- Jetpack CRM
- Fixed in
- 5.5
- What to do
- Update Jetpack CRM to 5.5 or newer.
Jan 2, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM.CVE-2015-10008 · Other software · 82Flex · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM. It has been classified as critical. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The identifier of the patch is 43bad79392332fa39e31b95268e76fbda9fec3a4. It is recommended to apply a patch to fix this issue. The identifier VDB-217185 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WEIPDCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic.CVE-2015-10007 · Other software · 82Flex · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is 43bad79392332fa39e31b95268e76fbda9fec3a4. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217184. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WEIPDCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting (XSS) vulnerability via the User profile component.CVE-2022-43271 · Other software · Inhabit · reported by MITREMedium 5.4
Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting (XSS) vulnerability via the User profile component.
- Product
- Move CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.cominhabit.com.au
Dec 18, 2022A vulnerability was found in luckyshot CRMx and classified as critical.CVE-2022-4592 · Other software · luckyshot · reported by VulDBMedium 6.3
A vulnerability was found in luckyshot CRMx and classified as critical. This issue affects the function get/save/delete/comment/commentdelete of the file index.php. The manipulation leads to sql injection. The attack may be initiated remotely. The name of the patch is 8c62d274986137d6a1d06958a6f75c3553f45f8f. It is recommended to apply a patch to fix this issue. The identifier VDB-216185 was assigned to this vulnerability.
- Product
- CRMx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Jetpack CRM: Does not sanitise and escape its settingsCVE-2022-3919 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Jetpack CRM
- Fixed in
- 5.4.3
- What to do
- Update Jetpack CRM to 5.4.3 or newer.
Nov 28, 2022ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.CVE-2022-36137 · Other software · Churchcrm · reported by MITREMedium 4.8
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgrimthereaperteam.medium.com
Nov 28, 2022ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.CVE-2022-36136 · Other software · Churchcrm · reported by MITREMedium 4.8
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgrimthereaperteam.medium.com
Nov 17, 2022Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.CVE-2022-43138 · Other software · Dolibarr · reported by MITRECritical 9.8
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 11, 2022A vulnerability was found in tholum crm42.CVE-2022-3955 · Other software · tholum · reported by VulDBHigh 7.3
A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\class\class.user.php of the component Login. The manipulation of the argument user_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213461 was assigned to this vulnerability.
- Product
- crm42
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile.CVE-2021-40303 · Other software · Perfexcrm · reported by MITREMedium 5.4
perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile.
- Product
- Perfex CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Oct 18, 2022Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Repository Utilities).CVE-2022-21598 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Repository Utilities). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - DB Deployment and Configuration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Core - DB Deployment and Configuration accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
- Product
- Siebel Core - DB Deployment and Configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection.CVE-2022-40871 · Other software · Dolibarr · reported by MITRECritical 9.8
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM).CVE-2022-39281 · Other software · fatfreecrm · reported by GitHubMedium 6.5
fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue.
- Product
- fat_free_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-3002 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.CVE-2022-38335 · Other software · Vtiger · reported by MITREMedium 5.4
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.vtiger.comgithub.com
Sep 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-3005 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-3004 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-3000 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.CVE-2022-2924 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP).CVE-2022-38846 · Other software · Espocrm · reported by MITREMedium 5.9
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.
- Product
- Espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containCVE-2022-38845 · Other software · Espocrm · reported by MITREMedium 6.1
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.
- Product
- Espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executCVE-2022-38844 · Other software · Espocrm · reported by MITREHigh 8
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.
- Product
- Espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server.CVE-2022-38843 · Other software · Espocrm · reported by MITREHigh 8.8
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server.
- Product
- Espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Microsoft Dynamics CRM (on-premises) Remote Code Execution VulnerabilityCVE-2022-35805 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
- Product
- Microsoft Dynamics CRM (on-premises) 9.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 13, 2022Microsoft Dynamics CRM (on-premises) Remote Code Execution VulnerabilityCVE-2022-34700 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
- Product
- Microsoft Dynamics CRM (on-premises) 9.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 24, 202272crm 9.0 has an Arbitrary file upload vulnerability.CVE-2022-37181 · Other software · 72crm · reported by MITRECritical 9.8
72crm 9.0 has an Arbitrary file upload vulnerability.
- Product
- Wukong CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022An issue was discovered in 72crm 9.0.CVE-2022-37178 · Other software · 72crm · reported by MITREHigh 8.8
An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar.
- Product
- Wukong CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-2829 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.