CVE-2024-36837

CVE-2024-36837 / CNVD-2024-30128 POC url.txt に URL を書き込んで CVE-2024-36837.py を実行してください CVE-2024-36837 大学1年生のとき、インターネット保護活動中に、ある教育機関がオンラインストアとして CRMEB Mall を使用していることを発見しました。テストの結果、SQL インジェクションの脆弱性が見つかりました。ローカル環境を構築して確認したところ、この脆弱性は CRMEB-KY v5.2.2 以上の CRMEB バージョンで発生することが判明しました。 Sqlmap: python...

CRMEB v.5.2.2 - SQL Injection

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file. id: CVE-2024-36837 info: name: CRMEB v.5.2.2 - SQL Injection author: DhiyaneshDk severity: high description: | SQL Injection...

CVE-2026-88467

The CRMEB Knowledge-Paid System (specifically crmeb_zzff_class version 1.4.4 ) contains a vulnerability in a backend verification function. The function returns an incorrect value type, which triggers errors and results in the leakage of sensitive information . No specific remediation steps, expl...

CVE-2026-88467

CRMEB Knowledge-Paid System crmebzzffclass 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information...

EUVD-2026-84204

CRMEB Knowledge-Paid System crmebzzffclass 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information...

CVE-2026-88467: Undefined Security Weakness

CRMEB Knowledge-Paid System crmebzzffclass 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information...

PT-2026-96267

CRMEB Knowledge-Paid System crmeb zzff class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information...

CVE-2026-79425

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

CVE-2026-79425

CRMEB v6.0.0 is affected by an authenticated Server-Side Request Forgery (SSRF) vulnerability in the /adminapi/file/online_upload component. This flaw allows an authenticated attacker to scan internal resources by sending a crafted POST request . While exploitation details are not explicitly prov...

PT-2026-92031

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/online upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

CVE-2026-79425

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

EUVD-2026-78625

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

CVE-2026-79425: Server-Side Request Forgery (SSRF)

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

CVE-2026-79425

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

CVE-2026-79426: External Control of File Name or Path

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

EUVD-2026-71770

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

CVE-2026-79426

The CRMEB v6.0.0 platform contains an arbitrary file deletion vulnerability within the /adminapi/file/video_data_save component. This flaw allows authenticated attackers to delete arbitrary files on the system by sending a crafted POST request . Exploitation details or specific proof-of-concept l...

PT-2026-86258

An arbitrary file deletion vulnerability in the /adminapi/file/video data save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...