crmeb_java 代码问题漏洞

crmebjava is a CRMEB open source Java mall system. A code issue vulnerability exists in crmebjava 1.3.4 and prior versions, which originates from an XML external entity reference and could allow a remote attacker to access sensitive information...

CVE-2025-25763

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead in /system/SystemDatabackupServices.php...

CVE-2025-25763

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead in /system/SystemDatabackupServices.php...

CVE-2025-25763

CVE-2025-25763 affects crmeb CRMEB-KY before/including v5.4.0. The issue is a SQL injection in the getRead() function of /system/SystemDatabackupServices.php, caused by unsafely constructed queries. CVSSv3.1 base score 9.8 (Network, Low attack complexity, No privileges, No user interaction) with ...

CVE-2025-25763

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead in /system/SystemDatabackupServices.php...

CVE-2025-25763

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead in /system/SystemDatabackupServices.php...

CVE-2025-25763

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead in /system/SystemDatabackupServices.php...

CVE-2024-52726

CRMEB v5.4.0 is vulnerable to Arbitrary file read in the savebasics function which allows an attacker to obtain sensitive information...

CVE-2024-52726

CRMEB v5.4.0 is vulnerable to Arbitrary file read in the savebasics function which allows an attacker to obtain sensitive information...

CVE-2024-52726

CRMEB v5.4.0 is vulnerable to Arbitrary file read in the savebasics function which allows an attacker to obtain sensitive information...

CVE-2024-52726

CRMEB v5.4.0 is vulnerable to Arbitrary file read in the savebasics function which allows an attacker to obtain sensitive information...

CVE-2024-52726

CRMEB v5.4.0 is vulnerable to an Arbitrary file read in the save_basics function, enabling an attacker to obtain sensitive information. The vulnerability is consistently described across varied sources (Red Hat, NVD, OSV, CIRCL, CNNVD, CVE lists) as a flaw in the save_basics routine, but concrete...

CVE-2024-50653

CRMEB =5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection...

CVE-2024-50653

CRMEB

CVE-2024-50653

CRMEB =5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection...

CVE-2024-50653

CRMEB =5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection...

CVE-2024-50653

CRMEB =5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection...

Exploit for SQL Injection in Crmeb

README.md CVE-2024-36837 Disclaimer Zhilianyunca...

CVE-2024-6944

A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function getimagebase64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has bee...

CVE-2024-6944 ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization

A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function getimagebase64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has bee...