vtiger

Top products

The 15 most recently published vulnerabilities affecting vtiger.

• CVE-2025-45755A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing...6.1May 21, 2025
• CVE-2025-45753A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature.7.2May 21, 2025
• CVE-2025-1618vTiger CRM index.php cross site scripting4.3Feb 24, 2025
• CVE-2024-54687Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.6.1Jan 10, 2025
• CVE-2024-48119Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML.5.4Oct 14, 2024
• CVE-2024-44779A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser vi...9.6Aug 29, 2024
• CVE-2024-44778A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via ...9.6Aug 29, 2024
• CVE-2024-44777A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via inj...9.6Aug 29, 2024
• CVE-2024-44776An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.6.1Aug 29, 2024
• CVE-2024-42995VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules.8.3Aug 16, 2024
• CVE-2024-42994VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module.7.2Aug 16, 2024
• CVE-2023-46304modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc...8.1Apr 30, 2024
• CVE-2023-38891SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php.8.8Sep 14, 2023
• CVE-2022-38335Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.5.4Sep 27, 2022
• CVE-2020-22807An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature.9.8Apr 29, 2021