CVE-2026-41452-PoC

CVE-2026-41452 — Krayin CRM Installer Auth Bypass → Admin Takeover CVSS 9.8 Critical · CWE-287 / CWE-306 · Jiva writeup · VulnCheck Summary Krayin CRM's installer exposes POST /install/api/admin-config-setup plus run-migration, run-seeder without CSRF protection withoutMiddleware'web' group. The...

CVE-2025-60374

CVE-2025-60374 CVE-2025-60374: Cross-Site Scripting XSS Almacenado en el Chatbot de Perfex CRM ⚠️ Aviso de seguridad Una vulnerabilidad crítica de Cross-Site Scripting Almacenado en la función de chatbot de Perfex CRM 📋 Resumen Una vulnerabilidad de cross-site scripting XSS almacenado en el...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM RCE Descripción Script PoC para vulnerabilidad crítica en Krayin CRM v2.2.x que permite RCE autenticado mediante carga de archivos sin restricciones. Uso root@kitploit: Web shell python3 exploit.py -u http://target.com -e [email protected] -p password123 Reverse...

EUVD-2026-75870

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-26720-Twenty-RCE

Twenty CRM - Authenticated Remote Code Execution RCE Overview Product: Twenty CRM Vulnerability: Remote Code Execution RCE via Serverless Workflow Functions Severity: Critical Affected Component: Workflow Automation Code - Serverless Function Tested Version: v1.15.0 This repository documents a...

CVE-2026-36340

CVE-2026-36340 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critical Affected Product: Krayin CRM v2.1.5 Vulnerability Type: Remote Code Execution RCE Authentication Required: Yes Summary A...

CVE-2024-56289

CVE-2024-56289 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Vulnerable version = 3.7.3.2 Component slug groundhogg Component link https://wordpress.org/plugins/groundhogg/ 3️⃣ OWASP...

CVE-2026-36392

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-36392

FairSketch Rise CRM (RISE – Ultimate Project Manager & CRM) versions ≤ 3.9.6 are affected by a stored XSS in the item title field. An authenticated administrator can inject arbitrary JavaScript into an item's title; the payload is stored server-side and executes in the browser of any client user ...

CVE-2025-60378

CVE-2025-60378: Stored HTML Injection in RISE Ultimate Project Manager & CRM ⚠️ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, messaging, and automated communications -ff6600 📋 Overview A critical Stored HTML Injection vulnerability has been discovered in RISE...

CVE-2026-36341

Cross-Site Scripting XSS vulnerability exists in Webkul Krayin CRM HTML Injection CVE: CVE-2026-36341 Summary The vulnerability is particularly critical because it affects the Admin Panel. In many CRM workflows, managers or higher-level admins review activities logged by staff. By injecting a...

CVE-2023-30253-exploit

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 Remote Code Execution PHP code injection exploit for Dolibarr ERP/CRM v17.0.0 that allows obtaining a reverse shell as www-data user via the Website/CMS module. ⚠️ For educational purposes and authorized audits only. 📑 Table of Contents What is...

CVE-2023-27742

CVE-2023-27742 Se descubrió que IDURAR ERP/CRM v1 contiene una vulnerabilidad de inyección SQL a través del componente /api/login. Descripción Se descubrió que IDURAR ERP/CRM v1 contiene una vulnerabilidad de inyección SQL a través del componente /api/login. Tipo de Vulnerabilidad Inyección SQL...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin < 4.7.2 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Groundhogg versions 4.7.2...

CVE-2021-40303

CVE-2021-40303 perfex crm 1.10 es vulnerable a Cross Site Scripting XSS Almacenado a través de /clients/profile. poc: root@kitploit: POST /clients/profile HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101 Firefox/78.0 Accept:...

Exploit-for-Dolibarr-17.0.0-CVE-2023-30253

Exploit POC para Dolibarr example: python3 exploit.py http://example.com login password 127.0.0.1 9001 ---Reverse Shell Exploit for Dolibarr = 17.0.0 CVE-2023-30253--- positional arguments: hostname Target hostname username Username of Dolibarr ERP/CRM password Password of Dolibarr ERP/CRM lhost...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 Introducción En el panorama en constante evolución de la ciberseguridad, las aplicaciones web siguen siendo un objetivo principal para los atacantes que buscan explotar vulnerabilidades. Recientemente, se descubrieron dos vulnerabilidades críticas en el Sistema...

CVE-2026-22356

CVE-2026-22356: Vulnerabilidad de Path Traversal y RCE en Jetpack CRM Advertencia: Esta herramienta debe utilizarse únicamente en entornos de prueba autorizados. El usuario es totalmente responsable del uso ilegal. 📥 Requisitos root@kitploit: pip3 install requests urllib3 $ python3 exploit.py...

VTIGER-CRM-RCE-CVE-2026-23698

Este repositorio no tiene un README...

KrayinCRM-RCE-Exploit-CVE-2026-38526

🔓 Krayin CRM v2.2.x - Exploit de Ejecución Remota de Código Autenticado ⚠️ SOLO PARA PRUEBAS DE SEGURIDAD AUTORIZADAS - El uso no autorizado es ilegal y poco ético. 📋 Resumen Esta herramienta de explotación demuestra una vulnerabilidad crítica de ejecución remota de código RCE autenticada...