CVE-2025-3219

The CVE-2025-3219 entry concerns CodeCanyon Perfex CRM 3.2.1. Affected is an unknown function in the file /perfex/clients/project/2 within the Project Discussions Module. The issue is a cross‑site scripting vulnerability triggered by manipulation of the argument description, with remote exploitat...

CVE-2017-17976

CVE-2017-17976 affects Perfex CRM 1.9.7 and stems from an unrestricted file upload in the utilities.php workflow, enabling remote code execution. Public sources confirm an arbitrary file upload path via the elfinder feature (elfinder_init) and mkfile, demonstrated by reports referencing shell.php...

CVE-2025-2974

CVE-2025-2974 affects CodeCanyon Perfex CRM (up to version 3.2.1). The vulnerability lies in the Contracts module, specifically the /contract code, where manipulation of input content enables cross-site scripting (XSS). Exploitation can be remote, and multiple sources note public disclosure of th...

CVE-2021-40303

Perfex CRM 1.10 is vulnerable to stored Cross Site Scripting (XSS) via /clients/profile due to insufficient input filtering/escaping in that endpoint. Exploitation could execute arbitrary scripts in a user’s browser, potentially compromising cookies/sessions. The connected documents confirm the i...

CVE-2024-8867

CVE-2024-8867 affects Perfex CRM 3.1.6. The vulnerability exists in an unknown portion of the code path related to the Parameter Handler, specifically file application/controllers/Clients.php, where manipulation of the message argument enables cross-site scripting (XSS). The attack is possible re...

CVE-2024-44851

Summary: CVE-2024-44851 is a stored XSS in Perfex CRM v1.1.0. The vulnerability resides in the Discussion section, where a crafted payload placed into the Content parameter can trigger script/HTML execution in browsers that view the page. Sources consistently identify the affected software as Per...

CVE-2020-28961

CVE-2020-28961 affects Perfex CRM v2.4.4. The vulnerability is a stored cross-site scripting (XSS) in the component path ./clients/client , exploitable via the company name parameter . This originates on the client side and can result in script execution when user input is rendered. From the prov...

CVE-2025-10341

Summary: CVE-2025-10341 affects Perfex CRM v3.2.1 with a stored HTML injection vulnerability in the /clients/client/x endpoint. The issue arises from insufficient validation of the POST parameter “company,” enabling stored HTML injection. Affected software: Perfex CRM 3.2.1 (web application). Vul...

CVE-2025-10343

CVE-2025-10343 describes a stored HTML injection in Perfex CRM v3.2.1 caused by insufficient validation of user input. An attacker can inject HTML by sending a POST request to the /expenses/expense endpoint, with the malicious content in the expense_name parameter. The connected sources confirm P...

CVE-2025-10342

Affected software : Perfex CRM v3.2.1. Vulnerability : HTML injection via stored input in the name parameter sent to POST /subscriptions/create. Root cause : insufficient validation/sanitization of user-supplied data in that endpoint. Impact : stored HTML injection; public-facing input could lead...

CVE-2025-10344

CVE-2025-10344 describes a stored HTML-injection vulnerability in Perfex CRM v3.2.1. The issue arises from insufficient validation of user input in the API at the endpoint /projects/project/x, where HTML can be injected via the POST parameters named, clientid. The core impact is stored HTML injec...

CVE-2025-10345

CVE-2025-10345 affects Perfex CRM in version 3.2.1. The issue is a stored HTML injection caused by insufficient validation of user input in the POST request to /admin/leads/lead, with malicious HTML supplied via the name and address parameters. Impact is described as stored HTML injection; exploi...

CVE-2025-10346

CVE-2025-10346 affects Perfex CRM v3.2.1 with a stored HTML injection in the knowledge_base/article endpoint. The vulnerability arises from insufficient input validation of the subject parameter, allowing an attacker to inject arbitrary HTML via a POST request. Multiple sources corroborate this: ...