Vtiger CRM v7.2.0 - Directory Listing

Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication. id: CVE-2020-19363 info: name: Vtiger CRM v7.2.0 - Directory...

CVE-2023-38891

CVE-2023-38891 VTiger 오픈소스 CRM v7.5의 인증된 SQL 인젝션 취약점 발견자: Jacob Elliott 2023년 7월 13일 요약 VTiger CRM v7.5.0의 보고서 모듈에서는 보고서에 대해 선택된 필드에 대한 검사가 충분하지 않아, 해당 필드가 저장된 후 보고서가 실행될 때 2차 SQL 인젝션으로 재도입됩니다. 이를 통해 공격자는 데이터베이스에서 사용자 비밀번호 해시, 웹서비스 API 액세스 키 및 기타 민감한 데이터를 포함한 임의의 필드를 유출할 수 있습니다. 개념 증명 CRM에 인증한 후,...

CVE-2023-46304

CVE-2023-46304 VTiger 오픈소스 CRM v7.5에서의 인증된 원격 코드 실행 요약 VTiger CRM 오픈소스 버전 7.5.0의 현재 릴리스에 있는 Users 모듈에 취약점이 존재합니다. 이 취약점은 인증된 공격자가 임의의 PHP 코드를 작성하여 config.inc.php에 실행시킬 수 있도록 합니다. 익스플로잇 상세 정보 사용자가 VTiger에 정상적으로 인증되면, 시스템은 사용자의 설정 상태를 확인하여 아직 완전히 구성되지 않은 새 사용자인지 확인합니다. 또한 첫 번째 사용자인지 확인합니다. 즉, 특정 글로...

CVE-2013-3214

CVE-2013-3214 vTiger 5.4.0 임의 파일 업로드를 통한 원격 코드 실행...

VTIGER-CRM-RCE-CVE-2026-23698

이 저장소에는 README가 없습니다...

VTIGER-CRM-RCE-CVE-2026-23697

이 저장소에는 README가 없습니다...

The vulnerability of the import function for modules of the vTiger CRM system’s client relationship management module allows a hacker to gain unauthorized access to protected information, upload arbitrary files, and execute arbitrary code.

The vulnerability of the module for importing customer relationship management files in vTiger CRM involves unlimited loading of dangerous types of files. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to protected information, load arbitrary files...

The vulnerability of the Documents module in the vTiger CRM system’s customer relationship management software allows a hacker to gain unauthorized access to protected information, upload arbitrary files, and execute arbitrary code.

The vulnerability of the Documents module in the vTiger CRM system’s customer relationship management software is related to the unlimited loading of dangerous types of files. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to protected information,...

📄 Vtiger CRM 8.3.0 / 8.4.0 Shell Upload

This repository contains a Python proof of concept for CVE-2026-23698, an authenticated remote code execution vulnerability affecting Vtiger CRM. The PoC implements two exploitation techniques: abusing the Module Manager to import a malicious module containing a PHP webshell, and on certain...

📄 Vtiger CRM 8.3.0 Shell Upload

This is a focused authenticated remote code execution proof of concept exploit for Vtiger CRM version 8.3.0. It logs into Vtiger, uploads a .phar PHP webshell through the Documents module, uses /storage/ directory listing to discover the randomized uploaded filename, then executes commands throug...

CVE-2026-23698

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents...

CVE-2026-23697

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the...

CVE-2026-23697

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the...

CVE-2026-23697 Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the...

CVE-2026-23697 Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the...

CVE-2026-23697

Vtiger CRM before 8.4.0 is vulnerable to an authenticated file upload RCE via the Documents module. An attacker with low privileges can upload a .phar file containing arbitrary PHP code, bypassing the extension denylist in config.inc.php (which omits .phar). The uploaded file is stored with its o...

EUVD-2026-42054

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents...

CVE-2026-23698

Vtiger CRM up to 8.4.0 is affected by an authenticated remote code execution vulnerability in the admin ModuleManager import feature. A privileged administrator can upload a crafted ZIP archive which is extracted directly into the web root’s modules/ directory without proper file-type validation ...

CVE-2026-23698 Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents...

CVE-2026-23698 Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents...