Read the docs

MicroPyramid

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

MicroPyramid records in CISA KEV

No MicroPyramid vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Django Crm 2 records MEDIUM

Records

6 records

TI-2026-74088 CVE-2026-110594 · GHSA-r225-9m2h-4x6v

ReDoS in BottleCRM case routing rule regex

Priority MEDIUM 64

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00644 Published 2026-10-14 No fix listed CWE-1333
TI-2026-74089 CVE-2026-110595 · GHSA-8vqj-3q69-wq28

Memory exhaustion in BottleCRM via contact and case CSV import

Priority MEDIUM 57

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00511 Published 2026-10-14 No fix listed CWE-770
TI-2026-74086 CVE-2026-110592 · GHSA-mpf8-4qc8-mc43

HTML injection in BottleCRM invoice PDF templates

Priority MEDIUM 56

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00362 Published 2026-10-14 No fix listed CWE-116
TI-2019-08552 CVE-2019-11457 · GHSA-pg2f-r7pc-6fxx

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via…

Priority MEDIUM 40

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportun…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01159 Published 2019-08-27 No fix listed CWE-352
TI-2026-74087 CVE-2026-110593 · GHSA-j2m5-qh4m-hfjr

Server-side template injection in BottleCRM via account email

Priority LOW 24

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template().

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00437 Published 2026-10-14 No fix listed CWE-1336
Open these records in search →