CVE-2026-26720-Twenty-RCE

Twenty CRM - Authenticated Remote Code Execution RCE Overview Product: Twenty CRM Vulnerability: Remote Code Execution RCE via Serverless Workflow Functions Severity: Critical Affected Component: Workflow Automation Code - Serverless Function Tested Version: v1.15.0 This repository documents a...

CVE-2026-36341

Cross-Site Scripting XSS vulnerability exists in Webkul Krayin CRM HTML Injection CVE: CVE-2026-36341 Summary The vulnerability is particularly critical because it affects the Admin Panel. In many CRM workflows, managers or higher-level admins review activities logged by staff. By injecting a...

CVE-2026-36340

CVE-2026-36340 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critical Affected Product: Krayin CRM v2.1.5 Vulnerability Type: Remote Code Execution RCE Authentication Required: Yes Summary A...

CVE-2025-60378

CVE-2025-60378: Stored HTML Injection in RISE Ultimate Project Manager & CRM ⚠️ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, messaging, and automated communications -ff6600 📋 Overview A critical Stored HTML Injection vulnerability has been discovered in RISE...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM Script usage example python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true Where --host is a SAP server...

CVE-2024-56289

CVE-2024-56289 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Vulnerable version Since this plugin uses the REST API, the Permalink must be set to Post name. 2. Subsequently, accessing...

CVE-2023-30253-exploit

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 Remote Code Execution Exploit de inyección de código PHP para Dolibarr ERP/CRM v17.0.0 que permite obtener una shell reversa como usuario www-data mediante el módulo Website/CMS. ⚠️ Solo para uso educativo y auditorías con autorización. 📑 Índice ¿Qué es...

CVE-2023-27742

CVE-2023-27742 Se descubrió que IDURAR ERP/CRM v1 contiene una vulnerabilidad de inyección SQL a través del componente /api/login. Descripción Se descubrió que IDURAR ERP/CRM v1 contiene una vulnerabilidad de inyección SQL a través del componente /api/login. Tipo de Vulnerabilidad Inyección SQL...

CVE-2021-40303

CVE-2021-40303 perfex crm 1.10 es vulnerable a Cross Site Scripting XSS Almacenado a través de /clients/profile. poc: POST /clients/profile HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101 Firefox/78.0 Accept:...

CVE-2023-38891

CVE-2023-38891 Authenticated SQL Injection Vulnerability in VTiger Open Source CRM v7.5 Discovered by: Jacob Elliott 07/13/23 Summary In the Reports module in VTiger CRM v7.5.0, there is insufficient checking of the selected fields for the report which are stored and then later reintroduced as a...

CVE-2026-90974

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...

CVE-2026-90972

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

WordPress WP Fusion Lite plugin < 3.48.0 - Unauthenticated CRM Integration Settings Update vulnerability

Unauthenticated CRM Integration Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Fusion Lite versions 3.48.0...

CVE-2026-90974 WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...

EUVD-2026-90515

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-90972

The WP Fusion Lite WordPress plugin, in versions prior to 3.48.0 , contains a vulnerability where it fails to perform a capability check on two of its admin AJAX handlers . This security oversight allows any authenticated subscriber to access sensitive information, specifically enabling them to r...

WordPress WP Fusion Lite plugin < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion vulnerability

Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion vulnerability discovered by Artus KG in WordPress Plugin WP Fusion Lite versions 3.48.0...

CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-90974

The WP Fusion Lite WordPress plugin (versions before 3.48.0 ) contains a vulnerability where a settings handler running during admin initialization does not require authentication. This allows unauthenticated users to overwrite the site's CRM integration endpoint and credentials. Once modified, s...