Vtiger Crm vulnerabilities

• vtiger crm Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module CVE-2026-23697 Public exploit 8.7 HighJuly 7, 2026
• vtiger crm Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload CVE-2026-23698 Public exploit 8.6 HighJuly 7, 2026
• vtiger crm A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0... CVE-2025-45755 6.1 MediumMay 21, 2025
• vtiger crm A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges... CVE-2025-45753 7.2 HighMay 21, 2025
• churchcrm crm vTiger CRM index.php cross site scripting CVE-2025-1618 5.3 MediumFebruary 24, 2025
• vtiger crm Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module... CVE-2024-54687 6.1 MediumJanuary 10, 2025
• vtiger crm Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users... CVE-2024-48119 5.4 MediumOctober 14, 2024
• vtiger crm A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page... CVE-2024-44779 9.6 CriticalAugust 29, 2024
• vtiger crm A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of... CVE-2024-44778 9.6 CriticalAugust 29, 2024
• vtiger crm A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of... CVE-2024-44777 9.6 CriticalAugust 29, 2024
• vtiger crm An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to... CVE-2024-44776 6.1 MediumAugust 29, 2024
• vtiger crm VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact... CVE-2024-42995 8.3 HighAugust 16, 2024
• vtiger crm VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement,... CVE-2024-42994 7.2 HighAugust 16, 2024
• vtiger crm modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run... CVE-2023-46304 Public exploit 8.1 HighApril 30, 2024
• vtiger crm SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to... CVE-2023-38891 Public exploit 8.8 HighSeptember 14, 2023
• vtiger crm Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via... CVE-2022-38335 5.4 MediumSeptember 27, 2022
• vtiger crm An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature. CVE-2020-22807 9.8 CriticalApril 29, 2021
• vtiger crm Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using ... CVE-2020-19363 6.5 MediumJanuary 20, 2021
• vtiger crm Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result... CVE-2020-19362 6.1 MediumJanuary 20, 2021
• vtiger crm vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability CVE-2013-3591 Public exploit EPSS 43.1% 8.8 HighFebruary 7, 2020
• vtiger crm Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in... CVE-2015-6000 Public exploit EPSS 40.2% 8.8 HighFebruary 6, 2020
• vtiger crm vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper... CVE-2013-3215 Public exploit EPSS 68.8% 9.8 CriticalJanuary 29, 2020
• vtiger crm vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. CVE-2013-3214 Public exploit EPSS 84.5% 9.8 CriticalJanuary 28, 2020
• vtiger crm vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php'... CVE-2013-3212 Public exploit 8.1 HighJanuary 28, 2020
• vtiger crm In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without... CVE-2019-19202 8.8 HighNovember 21, 2019
• vtiger crm vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting... CVE-2018-8047 6.1 MediumJune 6, 2019
• vtiger crm modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist... CVE-2016-10754 8.8 HighMay 24, 2019
• vtiger crm SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to... CVE-2019-11057 8.8 HighMay 17, 2019
• vtiger crm Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo... CVE-2019-5009 Public exploit 7.2 HighJanuary 4, 2019
• vtiger crm Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in... CVE-2016-1713 Public exploit EPSS 16.6% 7.3 HighApril 14, 2017
• vtiger crm modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user... CVE-2016-4834 8.1 HighAugust 1, 2016
• vtiger crm views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly... CVE-2014-2268 Public exploit EPSS 31.2% 5.0 MediumNovember 16, 2014
• vtiger crm Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security... CVE-2014-1222 Public exploit 4.0 MediumAugust 12, 2014
• vtiger crm modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to... CVE-2014-2269 Public exploit EPSS 15.7% 6.4 MediumApril 21, 2014
• vtiger crm Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers... CVE-2013-3213 Public exploit 7.5 HighApril 2, 2014
• vtiger crm Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject... CVE-2013-7326 4.3 MediumFebruary 14, 2014
• vtiger crm SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows... CVE-2013-5091 Public exploit 6.5 MediumOctober 4, 2013
• vtiger crm Directory traversal vulnerability in modules/com_vtiger_workflow/sortfieldsjson.php in vtiger CRM... CVE-2012-4867 Public exploit 5.0 MediumSeptember 6, 2012
• vtiger crm Multiple cross-site scripting (XSS) vulnerabilities in the customer portal in vtiger CRM before 5... CVE-2011-4680 4.3 MediumDecember 7, 2011
• vtiger crm vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads... CVE-2011-4679 4.0 MediumDecember 7, 2011
• vtiger crm Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote... CVE-2011-4670 Public exploit 4.3 MediumDecember 2, 2011
• vtiger crm SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote... CVE-2011-4559 Public exploit 7.5 HighNovember 28, 2011
• vtiger crm Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote... CVE-2010-3911 4.3 MediumNovember 26, 2010
• vtiger crm Multiple directory traversal vulnerabilities in the return_application_language function in... CVE-2010-3910 6.8 MediumNovember 26, 2010
• vtiger crm Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows... CVE-2010-3909 6.0 MediumNovember 26, 2010
• vtiger crm vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to... CVE-2009-3258 9.0 HighSeptember 18, 2009
• vtiger crm vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1)... CVE-2009-3257 3.6 LowSeptember 18, 2009
• vtiger crm include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 allows remote authenticated users to... CVE-2009-3251 4.0 MediumSeptember 18, 2009
• vtiger crm The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows... CVE-2009-3250 Public exploit EPSS 10.9% 9.0 HighSeptember 18, 2009
• vtiger crm Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to... CVE-2009-3249 Public exploit 7.5 HighSeptember 18, 2009
• Show olderLoading…