Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: MicroPyramid Clear all filters
TI-2026-74089 CVE-2026-110595 · GHSA-8vqj-3q69-wq28

Memory exhaustion in BottleCRM via contact and case CSV import

Priority MEDIUM 57

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00511 Published 2026-10-14 No fix listed CWE-770
TI-2026-74088 CVE-2026-110594 · GHSA-r225-9m2h-4x6v

ReDoS in BottleCRM case routing rule regex

Priority MEDIUM 64

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00644 Published 2026-10-14 No fix listed CWE-1333
TI-2026-74087 CVE-2026-110593 · GHSA-j2m5-qh4m-hfjr

Server-side template injection in BottleCRM via account email

Priority LOW 24

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template().

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00437 Published 2026-10-14 No fix listed CWE-1336
TI-2026-74086 CVE-2026-110592 · GHSA-mpf8-4qc8-mc43

HTML injection in BottleCRM invoice PDF templates

Priority MEDIUM 56

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00362 Published 2026-10-14 No fix listed CWE-116
TI-2019-08552 CVE-2019-11457 · GHSA-pg2f-r7pc-6fxx

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via…

Priority MEDIUM 40

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportun…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01159 Published 2019-08-27 No fix listed CWE-352