CVE-2026-15514

Metasoft MetaCRM (up to version 6.4.0 Beta06) contains a SQL injection vulnerability in PHPRPC Remote Call Interface, specifically in RPCService.query within /customizemt/xkq/rpc.jsp. The issue arises from manipulation of the argument phprpc_args, enabling remote exploitation. Public exploit avai...