CVE-2025-7874

CVE-2025-7874 affects Metasoft MetaCRM up to 6.4.2. The issue arises from manipulation of an unknown functionality in /env.jsp, causing information disclosure. The vulnerability is remotely exploitable and the exploit has been disclosed publicly. Multiple sources (NVD, Red Hat, CVE list entries, ...

CVE-2025-7879

Metasoft MetaCRM up to version 6.4.2 is affected by a vulnerability in the file mobileupload.jsp where manipulation of the File parameter allows unrestricted file upload. The root cause is an improper handling of the File argument in mobileupload.jsp, enabling remote exploitation. Impact stated a...

CVE-2025-7875

The CVE-2025-7875 entry concerns Metasoft MetaCRM (versions up to 6.4.2). The vulnerability affects an unspecified portion of the /debug.jsp file and results in improper authentication, enabling remote initiation of an attack. Public exploitation details exist in the sources, and the vendor was c...

CVE-2025-7880

The CVE-2025-7880 entry concerns Metasoft MetaCRM (versions up to 6.4.2). The vulnerability lies in the file /business/common/sms/sendsms.jsp, where manipulating the File argument enables unrestricted file upload. This is described as a remote attack with a disclosed exploit; the vulnerability is...

CVE-2025-7876

Metasoft MetaCRM

CVE-2025-7873

CVE-2025-7873 affects Metasoft MetaCRM up to version 6.4.2. Affected component: the file mcc_login.jsp where manipulating the workerid parameter leads to SQL injection. Impact: remote, with public exploit; vendor did not respond. Exploitation status and details are corroborated across multiple so...

CVE-2025-7878

CVE-2025-7878 affects Metasoft MetaCRM up to version 6.4.2. The vulnerability is an unrestricted file upload in an unknown function of the file /common/jsp/upload2.jsp, where manipulating the File argument enables remote exploitation. Exploitation is described as possible remotely, and public exp...

CVE-2025-7877

CVE-2025-7877 affects Metasoft MetaCRM up to version 6.4.2. The issue is an unrestricted file upload caused by manipulation of the File argument in the processing of sendfile.jsp, enabling remote attacks. Exploit has been publicly disclosed. A fix/patch availability is not documented in the provi...