11 matches found
PT-2026-96674
Name of the Vulnerable Software and Affected Versions WP-CRM System – Manage Clients and Projects versions prior to 3.4.7 Description Authenticated attackers with contributor-level access and above can extract sensitive data from arbitrary CRM contact records. This is achieved by enumerating the...
PT-2026-73181
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save contact of the component Contact Information Update. Such manipulation of the argument contact id leads to authorization bypass. The attack can...
CVE-2026-17432 NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improp...
CVE-2026-49141
WACRM vulnerability CVE-2026-49141: auth bypass in the automation engine allows an authenticated attacker to access/modify contacts of other tenants by sending a caller-controlled contact_id in a POST body, bypassing tenant ownership verification. Exploitation occurs via the service-role client t...
EUVD-2026-35194
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contactid in the POST request body without tenant ownership...
CVE-2026-49141 WACRM Authorization Bypass via Automation Engine Endpoint
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contactid in the POST request body without tenant ownership...
CVE-2024-45265
creationtimestamp| type| source ---|---|--- 2024-08-26 11:26:08+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/8369 2024-08-26 21:20:18+00:00| seen| https://t.me/cvedetector/4191...
CVE-2017-1002005
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contactid variable before adding it to the end of an SQL query...
PT-2017-10994
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of input sanitization in the DTracker plugin. Specifically, user input via the contact id variable is not properly sanitized before being added to an SQL query in the...
PT-2012-2190
Name of the Vulnerable Software and Affected Versions BrowserCRM versions 5.100.01 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the loginusername parameter to "index.php", the parent id parameter to "modules/Documents/versio...
