Vtiger CRM v7.2.0 - Directory Listing

Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication. id: CVE-2020-19363 info: name: Vtiger CRM v7.2.0 - Directory...

CRM Perks Forms <= 1.1.4 - SQL Injection

CRM Perks CRM Perks Forms affected versions 1.1.4 and earlier contains a SQL injection caused by improper neutralization of special elements used in an SQL command, letting attackers execute arbitrary SQL commands, exploit requires user interaction. id: CVE-2024-30498 info: name: CRM Perks Forms ...

CRM Perks Forms < 1.1.1 - Cross Site Scripting

The plugin does not sanitise and escape some parameters from a sample file before outputting them back in the page, leading to Reflected Cross-Site Scripting id: CVE-2022-38467 info: name: CRM Perks Forms 1.1.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | The plugin does...

CVE-2026-19966 CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/savecontact of the component Contact Information Update. Such manipulation of the argument contactid leads to authorization bypass. The attack can b...

CVE-2026-19966

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/savecontact of the component Contact Information Update. Such manipulation of the argument contactid leads to authorization bypass. The attack can b...

CVE-2026-50769

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

EUVD-2026-60357

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

CVE-2026-50769

The CRM+ application (version 2025.6 and earlier) by Brainformatik is vulnerable to time-based SQL injection in the CheckConflictOfDates endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true), which could allow an attacker to execute arbitrary code. No exploit or...

CVE-2026-19933

CVE-2026-19933 affects DefaultFuction Customer-Relationship-Management-In-C-Project 2.0, specifically the Customer Search Module. Affected component/function: Customer Search Module; root cause: manipulation of the function gets leads to a stack-based buffer overflow. Impact: enables remote attac...

CVE-2026-19933

A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made availabl...

CVE-2026-19871

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

CVE-2026-19871

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

EUVD-2026-58665

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

CVE-2026-19871 Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

CVE-2026-19871

CVE-2026-19871 affects Roskus Prospero Flow CRM prior to version 5.15.9. The root cause is use of hard-coded credentials where the employee save controller falls back to the literal password “changeme” and the onboarding form lacks a password field, enabling unauthenticated remote attackers who k...

CVE-2026-19870

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create...

CVE-2026-19870

The CVE-2026-19870 entry concerns Roskus Prospero Flow CRM (vendor Roskus) prior to version 5.15.10. It is an IDOR in the payroll module where authenticated users with read payroll permission can view salary and banking details of employees from other companies, and users with create payroll perm...

CVE-2026-19870 IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create...

CVE-2026-19734

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...

CVE-2026-19734 IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...