Total
7 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-25223 | 1 Crmeb | 1 Crmeb | 2023-03-14 | N/A | 7.2 HIGH |
| CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list. | |||||
| CVE-2023-1165 | 1 Crmeb | 1 Crmeb | 2023-03-10 | N/A | 7.2 HIGH |
| A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-222261 was assigned to this vulnerability. | |||||
| CVE-2022-44343 | 1 Crmeb | 1 Crmeb | 2023-02-14 | N/A | 7.5 HIGH |
| CRMEB 4.4.4 is vulnerable to Any File download. | |||||
| CVE-2020-21394 | 1 Crmeb | 1 Crmeb | 2021-07-02 | 6.5 MEDIUM | 8.8 HIGH |
| SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php. | |||||
| CVE-2020-21788 | 1 Crmeb | 1 Crmeb | 2021-07-01 | 4.0 MEDIUM | 4.3 MEDIUM |
| In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php. | |||||
| CVE-2020-21787 | 1 Crmeb | 1 Crmeb | 2021-06-30 | 10.0 HIGH | 9.8 CRITICAL |
| CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php. | |||||
| CVE-2020-25466 | 1 Crmeb | 1 Crmeb | 2020-10-27 | 7.5 HIGH | 9.8 CRITICAL |
| A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code. | |||||