Vulnerabilities

TI-2026-01417 CVE-2026-1734 · GHSA-qxq4-hr62-m2rg

Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization

HIGH 70

A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00526 Published 2026-02-01 No fix listed CWE-862

TI-2026-01416 CVE-2026-1733 · GHSA-fh73-r4jx-8p6f

Zhong Bang CRMEB :uni tidyOrder improper authorization

MEDIUM 57

A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00403 Published 2026-02-01 No fix listed CWE-266

TI-2026-00930 CVE-2026-1203 · GHSA-rj2q-p862-w9r3

CRMEB JSON Token LoginServices.php remoteRegister improper authentication

MEDIUM 61

A weakness has been identified in CRMEB up to 5.6.3.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00813 Published 2026-01-20 No fix listed CWE-287

TI-2026-00929 CVE-2026-1202 · GHSA-x64m-wg95-494x

CRMEB LoginController.php appleLogin improper authentication

HIGH 70

A security flaw has been discovered in CRMEB up to 5.6.3.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00925 Published 2026-01-20 No fix listed CWE-287

TI-2025-14086 CVE-2025-15443 · GHSA-g3px-2f97-p7gh

CRMEB product_export sql injection

MEDIUM 56

A vulnerability was identified in CRMEB up to 5.6.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00382 Published 2026-01-04 No fix listed CWE-74

TI-2025-14085 CVE-2025-15442 · GHSA-x9w7-fj93-8rc4

CRMEB product_list sql injection

MEDIUM 56

A vulnerability was determined in CRMEB up to 5.6.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00382 Published 2026-01-04 No fix listed CWE-74

TI-2025-10338 CVE-2025-11290 · GHSA-4mrh-386v-3qq4

CRMEB JWT HMAC Secret hard-coded key

MEDIUM 61

A vulnerability was identified in CRMEB up to 5.6.1.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00401 Published 2025-10-05 No fix listed CWE-320

TI-2025-10336 CVE-2025-11288 · GHSA-5537-m9qw-hvg3

CRMEB GET Parameter product sql injection

MEDIUM 57

A security flaw has been discovered in CRMEB up to 5.6.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0034 Published 2025-10-05 No fix listed CWE-74

TI-2025-09524 CVE-2025-10391 · GHSA-8mgm-5xv3-hp87

CRMEB OutAccountServices.php testOutUrl server-side request forgery

LOW 24

A security vulnerability has been detected in CRMEB up to 5.6.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00329 Published 2025-09-14 No fix listed CWE-918

TI-2025-09523 CVE-2025-10390 · GHSA-x9x4-xv57-6g86

CRMEB UserAddressServices.php editAddress improper authorization

LOW 24

A weakness has been identified in CRMEB up to 5.6.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00375 Published 2025-09-14 No fix listed CWE-266

TI-2025-09522 CVE-2025-10389 · GHSA-jfgw-c7c9-fxg2

CRMEB Administrator Password SystemAdminServices.php save improper authorization

LOW 24

A security flaw has been discovered in CRMEB up to 5.6.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00396 Published 2025-09-14 No fix listed CWE-266

TI-2025-19127 CVE-2025-25763 · GHSA-pfpf-6q8p-prjp

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php

MEDIUM 51

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00943 Published 2025-03-06 No fix listed CWE-89

TI-2024-35281 CVE-2024-52726 · GHSA-62x5-4rjc-x8j3

CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which…

LOW 38

CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01704 Published 2024-11-22 No fix listed CWE-125

TI-2024-34066 CVE-2024-50653 · GHSA-f927-34r4-vxxw

CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.

HIGH 72

CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00527 Published 2024-11-15 No fix listed CWE-284

TI-2024-06443 CVE-2024-6944 · GHSA-6w2x-vrj9-f72m

ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization

LOW 31

A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0378 Published 2024-07-21 No fix listed CWE-502

TI-2024-06442 CVE-2024-6943 · GHSA-cjr3-7gqx-mmmc

ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization

LOW 25

A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00607 Published 2024-07-21 No fix listed CWE-502

TI-2024-24421 CVE-2024-36837 · GHSA-294q-5vvf-xj65

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive…

HIGH 66

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08306 Published 2024-06-05 No fix listed CWE-89

TI-2024-01584 CVE-2024-1704 · GHSA-4x7r-c6x9-qgv3

ZhongBangKeJi CRMEB crud delete path traversal

LOW 36

A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2.

CVSS 3.1HIGH 8.1 Adjacent network No auth No interaction EPSS 0.00649 Published 2024-02-21 No fix listed CWE-22

TI-2024-01583 CVE-2024-1703 · GHSA-m9x5-g73r-5mcj

ZhongBangKeJi CRMEB openfile absolute path traversal

MEDIUM 59

A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00707 Published 2024-02-21 No fix listed CWE-36

TI-2023-03030 CVE-2023-3234 · GHSA-wx58-x3rj-qg57

Zhong Bang CRMEB PublicController.php put_image deserialization

MEDIUM 44

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01165 Published 2023-06-14 No fix listed CWE-502

TI-2023-03029 CVE-2023-3233 · GHSA-5g76-4vcr-3p8x

Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery

MEDIUM 40

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0082 Published 2023-06-14 No fix listed CWE-918

TI-2023-03028 CVE-2023-3232 · GHSA-38xh-3m6v-28q5

Zhong Bang CRMEB Image Upload app_auth deserialization

MEDIUM 44

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.012 Published 2023-06-14 No fix listed CWE-502

TI-2023-14160 CVE-2023-30185 · GHSA-hf6q-6gmr-2838

CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via…

MEDIUM 44

CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01116 Published 2023-05-08 No fix listed CWE-434

TI-2023-02273 CVE-2023-2419 · GHSA-9cg4-rqh4-h956

Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload

LOW 33

A vulnerability was found in Zhong Bang CRMEB 4.6.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00831 Published 2023-04-29 No fix listed CWE-434

TI-2023-01103 CVE-2023-1165 · GHSA-g25p-3656-783c

Zhong Bang CRMEB Java list sql injection

HIGH 65

A vulnerability was found in Zhong Bang CRMEB Java 1.3.4.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00763 Published 2023-03-03 No fix listed CWE-89

Vulnerabilities

Filters