Vulnerabilities

TI-2024-21944 CVE-2024-33117 · GHSA-245h-h68p-v4jq

crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

LOW 24

crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00468 Published 2024-05-06 No fix listed CWE-918

TI-2024-18959 CVE-2024-28714 · GHSA-rhp6-2jj3-53p2

SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to…

HIGH 70

SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00849 Published 2024-03-28 No fix listed CWE-89

TI-2024-16004 CVE-2024-24110 · GHSA-4jgg-53cv-7j3q

SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary…

MEDIUM 62

SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spread/people.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00613 Published 2024-02-29 No fix listed CWE-89

TI-2024-16761 CVE-2024-25469 · GHSA-5g9g-vh54-q73c

SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote…

HIGH 68

SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude parameters in the api/front/store/list component.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00786 Published 2024-02-23 No fix listed CWE-89

TI-2023-01514 CVE-2023-1609 · GHSA-fp5w-594q-2cg5

Zhong Bang CRMEB Java save cross site scripting

LOW 25

A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00517 Published 2023-03-23 No fix listed CWE-79

TI-2023-01513 CVE-2023-1608 · GHSA-wrjp-mp9q-w9xx

Zhong Bang CRMEB Java list getAdminList sql injection

MEDIUM 43

A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0063 Published 2023-03-23 No fix listed CWE-89

TI-2023-10676 CVE-2023-25223 · GHSA-c5r3-99p3-5g86

CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.

HIGH 67

CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00755 Published 2023-03-07 No fix listed CWE-89

Vulnerabilities

Filters

crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to…

SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary…

SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote…

Zhong Bang CRMEB Java save cross site scripting

Zhong Bang CRMEB Java list getAdminList sql injection

CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.