7638 matches found
CVE-2025-13788
A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public a...
CVE-2025-13788
chanjet crm is affected by a SQL injection in /tools/upgradeattribute.php via the gblOrgID parameter. The vulnerability affects Chanjet CRM versions up to 20251106 (pre-51107). Root cause: input manipulation in an unknown function leads to injectable SQL. Impact is high (remote attacker, data exp...
CVE-2025-13788 Chanjet CRM upgradeattribute.php sql injection
A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public a...
Chanjet CRM SQL注入漏洞
Chanjet CRM is a Customer Relationship Management system from China's Chanjet. A SQL injection vulnerability exists in Chanjet CRM 20251106 and earlier versions, which stems from incorrect manipulation of the parameter gblOrgID in the file /tools/upgradeattribute.php, which could lead to SQL...
PT-2025-48390
Name of the Vulnerable Software and Affected Versions Chanjet CRM versions prior to 20251107 Description A flaw exists in Chanjet CRM that allows for SQL injection. The issue is located in the /tools/upgradeattribute.php file, specifically within an unknown function. Manipulation of the gblOrgID...
CVE-2025-11461
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1...
EUVD-2025-199743
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1...
CVE-2025-11461
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1...
CVE-2025-11461 Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1...
CVE-2025-11461 Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller
Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1...
Frappe CRM SQL注入漏洞
Frappe CRM is a full-featured customer relationship management system from Frappe Open Source. A SQL injection vulnerability exists in Frappe CRM version 1.53.1, which stems from a user control parameter that is insecurely linked to a dynamic SQL statement, which could lead to a SQL injection...
CVE-2025-11800
The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-10054
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ehcrmremoveagent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, wit...
Small CRM manage-tickets.php file cross-site scripting vulnerability
Small CRM a customer relationship management system. Small CRM suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the aremark parameter of manage-tickets.php, which can be exploited to execute arbitrary Web scrip...
Small CRM manage-tickets.php file SQL Injection Vulnerability
Small CRM a customer relationship management system. Small CRM suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the frmid and aremark parameters of manage-tickets.php. An attacker can exploit this vulnerability to execu...
Small CRM quote-details.php file SQL Injection Vulnerability
Small CRM a customer relationship management system. Small CRM suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the id and adminremark parameters of quote-details.php. An attacker can exploit this vulnerability to...
Small CRM change-password.php File SQL Injection Vulnerability
Small CRM a customer relationship management system. Small CRM suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the oldpass parameter of change-password.php. This vulnerability can be exploited by an attacker to execute...
CVE-2024-44641
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php...