CVE-2025-42920

Due to a Cross-Site Scripting XSS vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation,...

SAP Supplier Relationship Management Cross-Site Scripting Vulnerability (CNVD-2025-21206)

SAP Supplier Relationship Management SRM is a supplier relationship management solution from SAP. The product automates purchasing and acquisition processes within an organization and between suppliers, and provides functions such as invoicing. A cross-site scripting vulnerability exists in SAP...

PT-2025-37148

The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the settings page function. This makes it possible for unauthenticated attackers to modify...

Small CRM /get-quote.php File SQL Injection Vulnerability

Small CRM is a customer relationship management system. Small CRM suffers from a SQL injection vulnerability, which originates from the /get-quote.php file, which does not perform security filtering on the Contact parameter. An attacker can exploit this vulnerability to illegally manipulate the...

CVE-2025-42920

Due to a Cross-Site Scripting XSS vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation,...

CVE-2025-42920

Due to a Cross-Site Scripting XSS vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation,...

CVE-2025-42920 Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management

Due to a Cross-Site Scripting XSS vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation,...

CVE-2025-42920

CVE-2025-42920 corresponds to a Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SRM). The issue arises from insufficient filtering/escaping of user-supplied data, enabling an unauthenticated attacker to craft a malicious link. When an authenticated user clicks th...

CVE-2025-42920 Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management

Due to a Cross-Site Scripting XSS vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation,...

SAP Supplier Relationship Management 跨站脚本漏洞

SAP Supplier Relationship Management SRM is a supplier relationship management solution from SAP. The product automates purchasing and acquisition processes within an organization and between suppliers, and provides functions such as invoicing. A cross-site scripting vulnerability exists in SAP...

Manpower Data Breach Hits 144K, Workday Confirms 3rd-Party CRM Hack

A cyberattack on Manpower's Michigan office compromised data for 144,000 people. Meanwhile, Workday reveals a data breach in…...

Malicious code in module-relationship (npm)

The package module-relationship was found to contain malicious code...

MAL-2025-26607 Malicious code in module-relationship (npm)

The package module-relationship was found to contain malicious code...

PHPGurukul Small CRM 安全漏洞

Small CRM is a customer relationship management system. Small CRM suffers from a session hijacking vulnerability that stems from the /crm/change-password.php component not terminating a session properly. No details of the vulnerability are available at this time...

From Text to Actionable Intelligence: Automating STIX Entity and Relationship Extraction

Sharing methods of attack and their effectiveness is a cornerstone of building robust defensive systems. Threat analysis reports, produced by various individuals and organizations, play a critical role in supporting security operations and combating emerging threats. To enhance the timeliness and...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2025-24079)

Oracle E-Business Suite is a fully integrated set of global business management software from Oracle USA. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle CRM Technical Foundation for...

CVE-2025-30739

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite component: Preferences. Supported versions that are affected are 12.2.11-12.2.13. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle CRM Technica...

07FLY多款产品 安全漏洞

07FLY-CMS and so on are products of China Zero Takeoff 07FLY company.07FLY-CMS is a free and open source content management system.07FLYCMS is a free and open source content management system.07Fly 07FLYCRM and so on are products of China Zero Takeoff 07Fly company.07FLYCRM is a customer...

WordPress plugin Lead Form Data Collection to CRM 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. An elevation of privilege vulnerability exists in the WordPress Lead Form Data Collection to CRM plugin, which stems from a missing capability check in the function...

AI and collaboration tools: how cyberattackers are targeting SMBs in 2025

Cyberattackers often view small and medium-sized businesses SMBs as easier targets, assuming their security measures are less robust than those of larger enterprises. In fact, attacks through contractors, also known as trusted relationship attacks, remain one of the top three methods used to brea...