TI-2024-34066 CVE-2024-50653 · GHSA-f927-34r4-vxxw
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.
Priority HIGH 72
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.
Zhong Bang
Records43All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high14CVSS 7.0–8.9
Exploited now
Zhong Bang records in CISA KEVNo Zhong Bang vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
30 records in Crmeb · all components
TI-2026-01417 CVE-2026-1734 · GHSA-qxq4-hr62-m2rg
Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization
Priority HIGH 70
A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3.
TI-2026-00929 CVE-2026-1202 · GHSA-x64m-wg95-494x
CRMEB LoginController.php appleLogin improper authentication
Priority HIGH 70
A security flaw has been discovered in CRMEB up to 5.6.3.
TI-2024-24421 CVE-2024-36837 · GHSA-294q-5vvf-xj65
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive…
Priority HIGH 66
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.
TI-2023-01103 CVE-2023-1165 · GHSA-g25p-3656-783c
Zhong Bang CRMEB Java list sql injection
Priority HIGH 65
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4.
TI-2026-00930 CVE-2026-1203 · GHSA-rj2q-p862-w9r3
CRMEB JSON Token LoginServices.php remoteRegister improper authentication
Priority MEDIUM 61
A weakness has been identified in CRMEB up to 5.6.3.
TI-2025-10338 CVE-2025-11290 · GHSA-4mrh-386v-3qq4
CRMEB JWT HMAC Secret hard-coded key
Priority MEDIUM 61
A vulnerability was identified in CRMEB up to 5.6.1.
TI-2024-01583 CVE-2024-1703 · GHSA-m9x5-g73r-5mcj
ZhongBangKeJi CRMEB openfile absolute path traversal
Priority MEDIUM 59
A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2.
TI-2026-01416 CVE-2026-1733 · GHSA-fh73-r4jx-8p6f
Zhong Bang CRMEB :uni tidyOrder improper authorization
Priority MEDIUM 57
A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3.
TI-2025-10336 CVE-2025-11288 · GHSA-5537-m9qw-hvg3
CRMEB GET Parameter product sql injection
Priority MEDIUM 57
A security flaw has been discovered in CRMEB up to 5.6.
TI-2025-14086 CVE-2025-15443 · GHSA-g3px-2f97-p7gh
CRMEB product_export sql injection
Priority MEDIUM 56
A vulnerability was identified in CRMEB up to 5.6.1.
TI-2025-14085 CVE-2025-15442 · GHSA-x9w7-fj93-8rc4
CRMEB product_list sql injection
Priority MEDIUM 56
A vulnerability was determined in CRMEB up to 5.6.1.
TI-2025-19127 CVE-2025-25763 · GHSA-pfpf-6q8p-prjp
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
Priority MEDIUM 51
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
TI-2020-15564 CVE-2020-25466 · GHSA-vm4j-2mrw-2c59
A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can…
Priority MEDIUM 47
A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.
TI-2020-14165 CVE-2020-21787 · GHSA-gmrc-j4q4-6cv6
CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
Priority MEDIUM 46
CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
TI-2023-14160 CVE-2023-30185 · GHSA-hf6q-6gmr-2838
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via…
Priority MEDIUM 44
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.
TI-2023-03030 CVE-2023-3234 · GHSA-wx58-x3rj-qg57
Zhong Bang CRMEB PublicController.php put_image deserialization
Priority MEDIUM 44
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0.
TI-2023-03028 CVE-2023-3232 · GHSA-38xh-3m6v-28q5
Zhong Bang CRMEB Image Upload app_auth deserialization
Priority MEDIUM 44
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical.
TI-2023-03029 CVE-2023-3233 · GHSA-5g76-4vcr-3p8x
Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery
Priority MEDIUM 40
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0.
TI-2022-21781 CVE-2022-44343 · GHSA-66rx-339r-mm8j
CRMEB 4.4.4 is vulnerable to Any File download.
Priority MEDIUM 40
CRMEB 4.4.4 is vulnerable to Any File download.
TI-2020-14046 CVE-2020-21394 · GHSA-f4gf-xh2w-prrv
SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and…
Priority MEDIUM 40
SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php.
TI-2024-35281 CVE-2024-52726 · GHSA-62x5-4rjc-x8j3
CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which…
Priority LOW 38
CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information
TI-2024-01584 CVE-2024-1704 · GHSA-4x7r-c6x9-qgv3
ZhongBangKeJi CRMEB crud delete path traversal
Priority LOW 36
A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2.
TI-2023-02273 CVE-2023-2419 · GHSA-9cg4-rqh4-h956
Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload
Priority LOW 33
A vulnerability was found in Zhong Bang CRMEB 4.6.0.
TI-2024-06443 CVE-2024-6944 · GHSA-6w2x-vrj9-f72m
ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization
Priority LOW 31
A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.