EUVD-2026-102493

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the createcustomer mutation to insert...

CVE-2026-111349

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the createcustomer mutation to insert...

CVE-2026-111349

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the createcustomer mutation to insert...

CVE-2026-111349

Craftplan versions through 0.7.5 are vulnerable to a missing authorization flaw within the CRM Customer resource. This vulnerability allows unauthenticated attackers to perform unauthorized actions by sending anonymous requests to the POST /api/json/customers endpoint or utilizing the create_cust...

PT-2026-115293

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create customer mutation to inser...

Shy Alter Craftplan Authorization Issue Vulnerability

Shy Alter Craftplan versions 0.7.5 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification for CRM customer resources. Unauthenticated attackers can create customer records by sending anonymous requests via JSON:API and GraphQL,...

XML Entity Injection Vulnerability in UFIDA U8+ CRM Customer Relationship Management Software

formerly known as Shanghai Qitong Software Co., Ltd., is a management digital service company that integrates the development, consulting, marketing, training, implementation and service of management software and Internet applications. An XML entity injection vulnerability exists in UFIDA U8+ CR...

Information leakage vulnerability in Chien Wang CRM customer management system

Thousand Wonders Software is a professional software developer. There is an information leakage vulnerability in Chivan's CRM customer management system, which can be exploited by attackers to obtain login account passwords...