Crmeb vulnerabilities

Products

• Crmeb 33
• Java 9

Newest

• crmeb CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift CVE-2026-111359 7.1 HighOctober 15, 2026
• crmeb java crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints CVE-2026-111354 2.3 LowOctober 15, 2026
• crmeb CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check CVE-2026-85212 8.7 HighSeptember 3, 2026
• crmeb CRMEB through 6.0.0 Unauthorized Message Modification via edit_message CVE-2026-85177 5.3 MediumSeptember 3, 2026
• crmeb java crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery CVE-2026-10771 6.9 MediumJune 3, 2026
• crmeb Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization CVE-2026-1734 6.9 MediumFebruary 1, 2026
• crmeb Zhong Bang CRMEB :uni tidyOrder improper authorization CVE-2026-1733 5.3 MediumFebruary 1, 2026
• crmeb CRMEB JSON Token LoginServices.php remoteRegister improper authentication CVE-2026-1203 6.3 MediumJanuary 20, 2026
• crmeb CRMEB LoginController.php appleLogin improper authentication CVE-2026-1202 6.9 MediumJanuary 20, 2026
• crmeb CRMEB product_export sql injection CVE-2025-15443 5.1 MediumJanuary 4, 2026
• crmeb CRMEB product_list sql injection CVE-2025-15442 5.1 MediumJanuary 4, 2026
• crmeb CRMEB JWT HMAC Secret hard-coded key CVE-2025-11290 6.3 MediumOctober 5, 2025
• crmeb CRMEB GET Parameter product sql injection CVE-2025-11288 5.3 MediumOctober 5, 2025
• crmeb CRMEB OutAccountServices.php testOutUrl server-side request forgery CVE-2025-10391 5.3 MediumSeptember 14, 2025
• crmeb CRMEB UserAddressServices.php editAddress improper authorization CVE-2025-10390 5.3 MediumSeptember 14, 2025
• crmeb CRMEB Administrator Password SystemAdminServices.php save improper authorization CVE-2025-10389 5.3 MediumSeptember 14, 2025
• crmeb crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system... CVE-2025-25763 Public exploit 9.8 CriticalMarch 6, 2025
• crmeb CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an... CVE-2024-52726 7.5 HighNovember 22, 2024
• crmeb CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end... CVE-2024-50653 7.5 HighNovember 15, 2024
• crmeb ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization CVE-2024-6944 5.3 MediumJuly 21, 2024
• crmeb ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization CVE-2024-6943 5.3 MediumJuly 21, 2024
• crmeb SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive... CVE-2024-36837 Public exploit 7.5 HighJune 5, 2024
• crmeb java crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the... CVE-2024-33117 5.3 MediumMay 6, 2024
• crmeb java SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute... CVE-2024-28714 8.1 HighMarch 28, 2024
• crmeb java SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL... CVE-2024-24110 6.5 MediumFebruary 29, 2024
• crmeb java SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to... CVE-2024-25469 7.5 HighFebruary 23, 2024
• crmeb ZhongBangKeJi CRMEB crud delete path traversal CVE-2024-1704 5.5 MediumFebruary 21, 2024
• crmeb ZhongBangKeJi CRMEB openfile absolute path traversal CVE-2024-1703 3.5 LowFebruary 21, 2024
• crmeb Zhong Bang CRMEB PublicController.php put_image deserialization CVE-2023-3234 4.3 MediumJune 14, 2023
• crmeb Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery CVE-2023-3233 6.3 MediumJune 14, 2023
• crmeb Zhong Bang CRMEB Image Upload app_auth deserialization CVE-2023-3232 6.3 MediumJune 14, 2023
• crmeb CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the... CVE-2023-30185 Public exploit 9.8 CriticalMay 8, 2023
• crmeb Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload CVE-2023-2419 4.7 MediumApril 29, 2023
• crmeb java, zhong bang crmeb java +1 more Zhong Bang CRMEB Java save cross site scripting CVE-2023-1609 3.5 LowMarch 23, 2023
• crmeb java, zhong bang crmeb java +1 more Zhong Bang CRMEB Java list getAdminList sql injection CVE-2023-1608 6.3 MediumMarch 23, 2023
• crmeb java CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list. CVE-2023-25223 7.2 HighMarch 7, 2023
• crmeb, zhong bang crmeb java +1 more Zhong Bang CRMEB Java list sql injection CVE-2023-1165 5.5 MediumMarch 3, 2023
• crmeb CRMEB 4.4.4 is vulnerable to Any File download. CVE-2022-44343 7.5 HighFebruary 6, 2023
• crmeb SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1... CVE-2020-21394 8.8 HighJune 29, 2021
• crmeb CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php. CVE-2020-21787 9.8 CriticalJune 24, 2021
• crmeb In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The... CVE-2020-21788 4.3 MediumJune 24, 2021
• crmeb A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely... CVE-2020-25466 9.8 CriticalOctober 23, 2020