CVE-2025-0462

CVE-2025-0462 affects Lingdang CRM up to version 8.6.0.0. The vulnerability is a SQL injection caused by manipulation of the searchcontent argument in the endpoint /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The issue can be exploited remotely; th...

CVE-2025-0461

CVE-2025-0461 affects Lingdang CRM (Shanghai Lingdang Information Technology) up to version 8.6.0.0. The vulnerability is a path traversal in the /crm/weixinmp/index.php endpoint, caused by improper handling of the pathfile argument, allowing remote exploitation. Public exploit/disclosure exists,...

CVE-2024-11122

CVE-2024-11122 affects Lingdang CRM up to version 8.6.4.3. The issue resides in the /crm/wechatSession/index.php?msgid=1&operation=upload endpoint, where manipulation of the file argument enables unrestricted file upload. The vulnerability is exploitable remotely and has been publicly disclosed. ...

CVE-2024-11121

Lingdang CRM

CVE-2025-5005

CVE-2025-5005 affects Lingdang CRM up to 8.6.5.4. The vulnerability is a server-side request forgery (SSRF) in an unknown function of the file crm/WeiXinApp/dingtalk/index_event.php, caused by manipulation of the corpurl argument. Reports indicate the attack can be launched remotely and that the ...

CVE-2024-11123

Lingdang CRM up to 8.6.4.3 exposes a path traversal issue in /crm/data/pdf.php via the url parameter, where input like ../config.inc.php can be manipulated to traverse the filesystem. The vulnerability allows remote initiation and has publicly disclosed exploits. Root cause is improper handling o...

CVE-2025-0463

CVE-2025-0463 affects Shanghai Lingdang Information Technology Lingdang CRM up to version 8.6.0.0. The vulnerability lies in an unknown function of the file /crm/weixinmp/index.php with the parameter name, where manipulation leads to unrestricted upload. This allows remote exploitation. Public ex...

CVE-2025-8219

CVE-2025-8219 affects Lingdang CRM up to version 8.6.4.7. The issue is an SQL injection in the HTTP POST Request Handler, caused by manipulation of the getvaluestring argument at /crm/crmapi/erp/tabdetail_moduleSave_dxkp.php. This can be triggered remotely. The vendor states all SQL injection vec...

CVE-2025-9140

Lingdang CRM up to version 8.6.4.7 is affected by an SQL injection in /crm/crmapi/erp/tabdetail_moduleSave.php via the getvaluestring parameter. Remote exploitation is possible and PoCs/exploits exist publicly (including time-based blind and boolean-based payloads). Vendor advisory indicates the ...

CVE-2025-8908

CVE-2025-8908 affects Lingdang CRM up to version 8.6.5.4. A SQL injection vulnerability exists in the file crm/WeiXinApp/yunzhijia/event.php via manipulation of the openid parameter, allowing remote exploitation. Public exploits have been disclosed. Upgrading to 8.6.5 or later patches all SQL inj...

CVE-2025-8345

CVE-2025-8345 affects Lingdang CRM up to version 8.6.4.7. The vulnerability is in the function delete_user of crm/WeiXinApp/yunzhijia/yunzhijiaApi.php, where manipulation of the function argument leads to SQL injection. The issue can be exploited remotely and exploit publicly disclosed. Remedies ...