The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. This allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers, operating remotely, to circumvent existing security mechanisms and gain unauthorized access to...

The vulnerability of the platform for creating individual web applications in CRM. The leader involved in this issue faces unlimited distribution of resources, allowing attackers to compromise the accessibility of protected information.

The vulnerability of the platform for creating individual web applications in CRM involves unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to compromise the accessibility of protected information...

The vulnerability of the platform for creating individual web applications in CRM involves a lack of measures to protect the SQL query structure, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

CVE-2023-38891

CVE-2023-38891 VTiger オープンソースCRM v7.5 における認証済みSQLインジェクションの脆弱性 発見者: Jacob Elliott 2023/07/13 概要 VTiger CRM v7.5.0 のレポートモジュールでは、レポートの選択フィールドに対するチェックが不十分であり、それらが保存され、後でレポート実行時に二次SQLインジェクションとして再導入されます。これにより、攻撃者はデータベースから任意のフィールド（ユーザーパスワードハッシュ、WebサービスAPIアクセスキー、その他の機密データ）を漏洩させることができます。 実証概念...

CVE-2026-22356

CVE-2026-22356: Jetpack CRM 路径遍历漏洞和远程代码执行 警告： 此工具仅应用于授权的测试环境。非法使用完全由用户负责。 📥 要求 root@kitploit: pip3 install requests urllib3 $ python3 exploit.py https://example.com --rce --cmd "id" + Target is VULNERABLE to LFI! Attempting Log Poisoning for RCE... Searching for accessible log files... Trying:...

CVE-2026-85055

Twenty is an open-source CRM platform. Prior to version 2.22.0 , field-level read permissions are enforced on selected output fields but not on GraphQL or REST filter predicates . A workspace member or API key with object-level read access but denied field-level access can reference the restricte...

CVE-2023-46304

CVE-2023-46304 VTiger Open Source CRM v7.5 における認証済みリモートコード実行 概要 VTiger CRM Open Source バージョン 7.5.0 の現在のリリースの Users モジュールには、認証された攻撃者が config.inc.php に任意の PHP コードを書き込んで実行できるようにする脆弱性が存在します。 エクスプロイトの詳細 ユーザーが通常どおり VTiger に認証されると、VTiger...

CVE-2024-39304

説明 このスクリプトはCVE-2024-39304のPoCです。ChurchCRMプロジェクトにおけるサニタイズ不足によりSQLiが可能となる脆弱性です。 使い方 python3 CVE-2024-39304.py -u -p -b -v 例: python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v リンク https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2rh6-gr3h-83j9...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

VTIGER-CRM-RCE-CVE-2026-23698

このリポジトリには README がありません。...

CVE-2019-9745

著者: Arn Vollebregt はじめに 創造性はペネトレーションテストの核心であり、それが私たちの仕事を面白くしています。しかし、1つの落とし穴は、攻撃シナリオを「過剰設計」し、バグ（エラー条件）のみに焦点を当てる傾向があることです。しかし、欠陥（意図しない動作）も同様に壊滅的な結果をもたらす可能性があります。この記事は、そのような欠陥に対するペンテストの重要性を示すケーススタディを提供します。同時に、SDLC（セキュア開発ライフサイクル）プロセスの採用を提唱します。...

KrayinCRM-RCE-Exploit-CVE-2026-38526

🔓 Krayin CRM v2.2.x - 인증된 원격 코드 실행 익스플로잇 ⚠️ 승인된 보안 테스트 전용 - 무단 사용은 불법이며 비윤리적입니다. 📋 개요 이 익스플로잇 도구는 Krayin CRM 버전 2.2.x 에서 발견된 중요 인증된 원격 코드 실행RCE 취약점을 시연합니다. 이 취약점은 TinyMCE 파일 업로드 기능에 존재하며, 인증된 관리자가 서버에 임의의 PHP 코드를 업로드하고 실행할 수 있게 합니다. 속성| 값 ---|--- CVE ID| CVE-2026-38526 영향받는 소프트웨어| Krayin CRM v2.2....

Vtiger CRM v7.2.0 - Directory Listing

Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication. id: CVE-2020-19363 info: name: Vtiger CRM v7.2.0 - Directory...

CRM Perks Forms < 1.1.1 - Cross Site Scripting

The plugin does not sanitise and escape some parameters from a sample file before outputting them back in the page, leading to Reflected Cross-Site Scripting id: CVE-2022-38467 info: name: CRM Perks Forms 1.1.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | The plugin does...

CRM Perks Forms <= 1.1.4 - SQL Injection

CRM Perks CRM Perks Forms affected versions 1.1.4 and earlier contains a SQL injection caused by improper neutralization of special elements used in an SQL command, letting attackers execute arbitrary SQL commands, exploit requires user interaction. id: CVE-2024-30498 info: name: CRM Perks Forms ...

Krayin CRM < 2.2.1 - Installer Authentication Bypass

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrati...

Hack-The-Box-Nexus-Findings-Report

🛡️ Hack The Box - Nexus 发现报告 📋 概述 本仓库包含针对 Hack The Box 机器 Nexus 的全面渗透测试报告。 🔍 关键发现 Gitea 提交历史中泄露的凭据 - 中危 Krayin CRM 无限制文件上传 CVE-2026-38526 - 高危 Gitea 模板同步目录遍历 - 严重 用户 flag 已捕获：3290dde5fca195ea451632d54d4b60da root flag 已捕获：c25914b5b518500d1c71da5c8331ac9d 🛠️ 使用的框架 PentNote - 自动化文档 -...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 SAP NetWeaver AS JAVA CRM上のログインジェクションを介したリモートコマンド実行のPoC スクリプト使用例 root@kitploit: python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true ここで --host はSAPサーバーのIP --port SAP NetWeaver AS...