Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

13 records

Vendor: Perfex CRM Component: Perfex Crm Clear all filters
TI-2025-09488 CVE-2025-10346 · GHSA-rcv7-m37q-g2mp

HTML injection in Perfex CRM

Priority LOW 29

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knoewledge_bas…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00194 Published 2025-09-29 No fix listed CWE-79
TI-2025-09487 CVE-2025-10345 · GHSA-89rh-477v-cfc4

HTML injection in Perfex CRM

Priority LOW 30

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'address' at the endpoint 'adm…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00237 Published 2025-09-29 No fix listed CWE-79
TI-2025-09486 CVE-2025-10344 · GHSA-2g62-g2mp-x72c

HTML injection in Perfex CRM

Priority LOW 30

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'clientid' at the endpoint '/p…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00237 Published 2025-09-29 No fix listed CWE-79
TI-2025-09485 CVE-2025-10343 · GHSA-6m2r-pmx8-6p54

HTML injection in Perfex CRM

Priority LOW 30

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'expense_name' at the endpoint '/expenses/…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00237 Published 2025-09-29 No fix listed CWE-79
TI-2025-09484 CVE-2025-10342 · GHSA-cpvj-9j3q-pq89

HTML injection in Perfex CRM

Priority LOW 30

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'name' at the endpoint '/subscriptions/cre…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00237 Published 2025-09-29 No fix listed CWE-79
TI-2025-09483 CVE-2025-10341 · GHSA-2w98-wcf4-f6w2

HTML injection in Perfex CRM

Priority LOW 30

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint '/clients/client…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00237 Published 2025-09-29 No fix listed CWE-79
TI-2024-30018 CVE-2024-44851 · GHSA-vj8g-fr32-2wcg

A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM…

Priority MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00397 Published 2024-09-11 No fix listed CWE-79