Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
VtigerVtiger Crm5.0.4

14 matches found

CVE
CVE•added 2013/10/04 8:55 p.m.•60 views

CVE-2013-5091

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559.

6.5CVSS8AI score0.01004EPSS
CVE
CVE•added 2010/11/26 8:0 p.m.•56 views

CVE-2010-3910

Multiple directory traversal vulnerabilities in the return_application_language function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang_crm parameter to phprint.php or (2) the current_langu...

6.8CVSS7.3AI score0.01489EPSS
CVE
CVE•added 2014/11/16 1:59 a.m.•56 views

CVE-2014-2268

views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the db_name parame...

5CVSS6.9AI score0.77294EPSS
CVE
CVE•added 2014/04/02 4:5 p.m.•52 views

CVE-2013-3213

Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name parameter in the get_picklists method to soap/customerportal.php, (2) where parameter in the get_tickets_list method to soap/customerportal.php...

7.5CVSS9.6AI score0.00315EPSS
CVE
CVE•added 2010/11/26 8:0 p.m.•45 views

CVE-2010-3909

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request ...

6CVSS7.5AI score0.02627EPSS
CVE
CVE•added 2009/09/18 8:30 p.m.•44 views

CVE-2009-3248

Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php.

6.8CVSS7.1AI score0.00273EPSS
CVE
CVE•added 2011/11/28 9:55 p.m.•44 views

CVE-2011-4559

SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php.

7.5CVSS8.6AI score0.01004EPSS
CVE
CVE•added 2009/09/18 8:30 p.m.•43 views

CVE-2009-3249

Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the module parameter to graph.php; or the (2) module or (3) file parameter to include/Ajax/CommonAjax.php, reachable through modules/Campaig...

7.5CVSS6.9AI score0.25994EPSS
CVE
CVE•added 2009/09/18 8:30 p.m.•41 views

CVE-2009-3247

Cross-site scripting (XSS) vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the query_string vector is already covered by CVE-2008-3101.3.

4.3CVSS5.6AI score0.06564EPSS
CVE
CVE•added 2009/09/18 8:30 p.m.•40 views

CVE-2009-3250

The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (...

9CVSS7.3AI score0.15858EPSS
CVE
CVE•added 2008/09/03 2:12 p.m.•39 views

CVE-2008-3101

Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the user_password parameter in an Authenticate action ...

4.3CVSS5.6AI score0.06564EPSS
CVE
CVE•added 2010/11/26 8:0 p.m.•39 views

CVE-2010-3911

Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username (aka default_user_name) field or (2) the password field in a Users Login action to index.php, or (3) the label parameter in a Settings Ge...

4.3CVSS6AI score0.00365EPSS
CVE
CVE•added 2009/09/18 9:30 p.m.•35 views

CVE-2009-3258

vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete (1) attachments, (2) reports, (3) filters, (4) views, and (5) tickets; insert (6) attachments, (7) reports, (8) filters, (9) views, and (10) tickets; and edit (11) reports, (12) filters, (13) views, a...

9CVSS6.3AI score0.0044EPSS
CVE
CVE•added 2011/12/07 7:55 p.m.•35 views

CVE-2011-4680

Multiple cross-site scripting (XSS) vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00263EPSS