CVE-2026-60489

Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards component: CRM Foundation. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne C...

CVE-2026-47036

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Siebel Approval Manager. Supported versions that are affected are 17.0-26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development...

CVE-2026-47016

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Event Publish and Subscribe. Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows physical access to compromise Siebel CRM Integration. While the vulnerability is in Siebel...

CVE-2026-47011

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Application Interface. Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment...

PT-2026-62555

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2 Description A flaw in the CRM Foundation component allows a low-privileged attacker with network access via JDENET to compromise the system. Successful exploitation can lead to a full...

PT-2026-62548

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2 Description A flaw in the CRM Foundation component allows a low-privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a complet...

PT-2026-62737

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel CRM Cloud Applications versions 22.3 through 26.5 Description A flaw in the Siebel Cloud Manager component allows a low privileged attacker with network access via HTTP to compromise the application. Successful...

PT-2026-62732

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud...

📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection

WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

PT-2026-62721

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel CRM Cloud Applications versions 22.3 through 26.5 Description A flaw in the Siebel Cloud Manager component allows an unauthenticated attacker with network access via HTTP to compromise the application. This can lead to...

PT-2026-62197

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.3 Description An issue exists in the Siebel Approval Manager component of the Siebel CRM Development product. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromi...

CVE-2026-55550

NextCRM is affected by an RBAC bypass in the MCP product tools. In version 0.12.1, write operations for the product catalog were exposed via /api/mcp/mcp using user-generated Bearer tokens without proper role checks, allowing any authenticated low-privileged user to create, modify, archive, or so...

CVE-2026-16222

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress result...

CVE-2026-16223

1Panel-dev CordysCRM up to 1.4.1 is affected in the Third Party Edit Endpoint, specifically the IntegrationConfigService.getSqlBotSrc function. A manipulated appSecret can trigger server-side request forgery (SSRF) and the issue can be exploited remotely. The exploit has been publicly disclosed a...

CVE-2026-16222

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress result...

CVE-2026-9734

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2026-9734 W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2026-9734

The CVE-2026-9734 entry concerns the W3SC Elementor to Zoho CRM plugin for WordPress. A CSRF vulnerability exists in all versions up to 2.2.0 due to missing or incorrect nonce validation in the storeInfo function, enabling unauthenticated attackers to alter Zoho CRM integration settings by forgin...

CVE-2026-9734

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

PT-2026-60920

Name of the Vulnerable Software and Affected Versions W3SC Elementor to Zoho CRM versions prior to 2.2.1 Description The plugin is subject to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or...