Vulnerabilities

Filters

Reset all

1 selected

53 records

Sort

Vendor: Rukovoditel Clear all filters

TI-2026-24398 CVE-2026-31845 · GHSA-hxff-cjjh-cmf4

Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

HIGH 73

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php).

CVSS 4.0CRITICAL 9.3 Network No auth User interaction EPSS 0.00435 Published 2026-04-11 Fixed in 3.7 CWE-79

TI-2023-30196 CVE-2023-53913 · GHSA-rcqj-85jm-wmw8

Rukovoditel 3.3.1 CSV Injection via User Account Export

MEDIUM 61

Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.00732 Published 2025-12-17 No fix listed CWE-1236

TI-2023-30181 CVE-2023-53898 · GHSA-6598-86pr-wm97

Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Configuration

MEDIUM 56

Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-16 No fix listed CWE-79

TI-2023-30180 CVE-2023-53897 · GHSA-w8hg-xmw6-8fvg

Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments

MEDIUM 56

Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-16 No fix listed CWE-79

TI-2024-22799 CVE-2024-34469 · GHSA-q82h-pmf9-x2xf

Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.

MEDIUM 64

Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00589 Published 2024-05-04 No fix listed CWE-79

TI-2024-22798 CVE-2024-34468 · GHSA-8j9h-4rqp-j66g

Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.

LOW 27

Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00342 Published 2024-05-04 No fix listed CWE-79

TI-2022-23834 CVE-2022-48175 · GHSA-3g23-95wx-3cc6

Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability…

HIGH 82

Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0174 Published 2023-01-30 No fix listed CWE-94

TI-2022-22128 CVE-2022-45020 · GHSA-pqpr-w68x-43cr

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS)…

HIGH 71

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00617 Published 2022-12-05 No fix listed CWE-79

TI-2022-22105 CVE-2022-44952 · GHSA-g82r-v699-q3p8

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 60

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00991 Published 2022-12-02 No fix listed CWE-79

TI-2022-22104 CVE-2022-44951 · GHSA-9q4r-4j83-rq5m

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 60

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01027 Published 2022-12-02 No fix listed CWE-79

TI-2022-22103 CVE-2022-44950 · GHSA-fhg7-w742-r4m6

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01049 Published 2022-12-02 No fix listed CWE-79

TI-2022-22102 CVE-2022-44949 · GHSA-35c8-q6x2-rx7f

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01049 Published 2022-12-02 No fix listed CWE-79

TI-2022-22101 CVE-2022-44948 · GHSA-58hx-jfqv-58wx

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00982 Published 2022-12-02 No fix listed CWE-79

TI-2022-22100 CVE-2022-44947 · GHSA-3r5j-phw6-cxph

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01054 Published 2022-12-02 No fix listed CWE-79

TI-2022-22099 CVE-2022-44946 · GHSA-hxxw-7qv6-75jv

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01128 Published 2022-12-02 No fix listed CWE-79

TI-2022-22098 CVE-2022-44945 · GHSA-8727-g4p6-v7h7

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.

HIGH 82

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00953 Published 2022-12-02 No fix listed CWE-89

TI-2022-22097 CVE-2022-44944 · GHSA-55cm-jv9m-hwg9

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01137 Published 2022-12-02 No fix listed CWE-79

TI-2022-21130 CVE-2022-43288 · GHSA-pr7f-w5w8-8mp6

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the…

HIGH 73

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0089 Published 2022-11-14 No fix listed CWE-89

TI-2022-21066 CVE-2022-43170 · GHSA-xf87-5w9c-m6cq

A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01095 Published 2022-10-28 No fix listed CWE-79

TI-2022-21065 CVE-2022-43169 · GHSA-jmw7-4jx6-672c

A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01207 Published 2022-10-28 No fix listed CWE-79

TI-2022-21064 CVE-2022-43168 · GHSA-w94c-984j-7hp6

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

HIGH 76

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01096 Published 2022-10-28 No fix listed CWE-89

TI-2022-21063 CVE-2022-43167 · GHSA-3hh9-hvm7-hpc8

A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML vi…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01164 Published 2022-10-28 No fix listed CWE-79

TI-2022-21062 CVE-2022-43166 · GHSA-4mrm-8fhj-6fh8

A stored cross-site scripting (XSS) vulnerability in the Global Entities feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a c…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01095 Published 2022-10-28 No fix listed CWE-79

TI-2022-21061 CVE-2022-43165 · GHSA-fpp7-4jrj-q54q

A stored cross-site scripting (XSS) vulnerability in the Global Variables feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a c…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01095 Published 2022-10-28 No fix listed CWE-79

TI-2022-21060 CVE-2022-43164 · GHSA-xp38-vhvm-v2x7

A stored cross-site scripting (XSS) vulnerability in the Global Lists feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a cra…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01095 Published 2022-10-28 No fix listed CWE-79