Crm

This hub aggregates every CVE we track for Crm, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Crm.

• CVE-2021-48008Chanjet CRM SQL Injection via get_usedspace.php7.5Sep 18, 2026
• CVE-2026-92418ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting3.5Sep 16, 2026
• CVE-2026-92402ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization6.3Sep 16, 2026
• CVE-2026-92401ChangeWeDer crm improper authentication7.3Sep 16, 2026
• CVE-2026-86172DefaultFuction CRM delete.php sql injection6.3Sep 6, 2026
• CVE-2026-86171DefaultFuction CRM delete.php sql injection6.3Sep 6, 2026
• CVE-2026-86170DefaultFuction CRM edit.php sql injection6.3Sep 6, 2026
• CVE-2026-53761Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/apiSep 4, 2026
• CVE-2026-84111Chanjet CRM jxf_dump_table.php sql injection7.3Sep 1, 2026
• CVE-2026-58411ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and valuesJul 13, 2026
• CVE-2026-58410ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records7.1Jul 13, 2026
• CVE-2026-58409ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload9.1Jul 13, 2026
• CVE-2026-58408ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII6.5Jul 13, 2026
• CVE-2026-11456Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection7.3Jun 7, 2026
• CVE-2026-44548ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)8.1May 12, 2026