Vulnerabilities

TI-2014-04480 CVE-2014-5520 · GHSA-4mm8-64vx-2c9r

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to…

LOW 38

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the user_id parameter to plugins/webform/new-form.php, which is not properly handled by plugins/user…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02555 Published 2014-10-26 No fix listed CWE-89

TI-2014-04481 CVE-2014-5521 · GHSA-gv2h-2fv2-j9q3

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote…

LOW 39

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0707 Published 2014-09-02 No fix listed CWE-89

Vulnerabilities

Filters

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to…

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote…