CVE-2026-10771 | High | 7.3 | 2026-06-03 | A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/ut… |
CVE-2026-1734 | Medium | 5.3 | 2026-02-02 | A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabCon… |
CVE-2026-1733 | Medium | 4.3 | 2026-02-01 | A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/store_integral/order/detail/:uni. T… |
CVE-2026-1203 | Medium | 5.6 | 2026-01-20 | A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php… |
CVE-2026-1202 | High | 7.3 | 2026-01-20 | A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginControll… |
CVE-2025-15443 | Medium | 4.7 | 2026-01-04 | A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation… |
CVE-2025-15442 | Medium | 4.7 | 2026-01-04 | A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of th… |
CVE-2025-11290 | Medium | 5.6 | 2025-10-05 | A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argume… |
CVE-2025-11288 | Medium | 6.3 | 2025-10-05 | A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET P… |
CVE-2025-10391 | Medium | 6.3 | 2025-09-14 | A security vulnerability has been detected in CRMEB up to 5.6.1. The impacted element is the function testOutUrl of the file app/services/out/OutAccountService… |
CVE-2025-10390 | Medium | 5.4 | 2025-09-14 | A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Ex… |
CVE-2025-10389 | Medium | 5.4 | 2025-09-14 | A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the co… |
CVE-2025-25763 | Critical | 9.8 | 2025-03-06 | crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php |
CVE-2024-52726 | High | 7.5 | 2024-11-22 | CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information |
CVE-2024-50653 | High | 7.5 | 2024-11-15 | CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packe… |
CVE-2024-6944 | Medium | 6.3 | 2024-07-21 | A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file Pu… |
CVE-2024-6943 | Medium | 6.3 | 2024-07-21 | A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of t… |
CVE-2024-36837 | High | 7.5 | 2024-06-05 | SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController… |
CVE-2024-33117 | Medium | 5.3 | 2024-05-06 | crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController. |
CVE-2024-28714 | High | 8.1 | 2024-03-28 | SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter. |
CVE-2024-24110 | Medium | 6.5 | 2024-03-21 | SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spre… |
CVE-2024-25469 | High | 7.5 | 2024-02-23 | SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude para… |
CVE-2024-1704 | Medium | 5.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been declared as critical. This vulnerability affects the function save/delete of the file /admi… |
CVE-2024-1703 | Low | 3.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/… |
CVE-2023-3234 | Medium | 4.3 | 2023-06-14 | A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been declared as problematic. Affected by this vulnerability is the function put_image of the… |
CVE-2023-3233 | Medium | 6.3 | 2023-06-14 | A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/contro… |
CVE-2023-3232 | Medium | 6.3 | 2023-06-14 | A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/app_au… |
CVE-2023-30185 | Critical | 9.8 | 2023-05-08 | CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php. |
CVE-2023-2419 | Medium | 4.7 | 2023-04-29 | A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file \crmeb\a… |
CVE-2023-1609 | Low | 3.5 | 2023-03-23 | A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/s… |
CVE-2023-1608 | Medium | 6.3 | 2023-03-23 | A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the f… |
CVE-2023-25223 | High | 7.2 | 2023-03-07 | CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list. |
CVE-2023-1165 | Medium | 5.5 | 2023-03-03 | A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/… |
CVE-2022-44343 | High | 7.5 | 2023-02-06 | CRMEB 4.4.4 is vulnerable to Any File download. |
CVE-2020-21394 | High | 8.8 | 2021-06-29 | SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php. |
CVE-2020-21788 | Medium | 4.3 | 2021-06-24 | In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyT… |
CVE-2020-21787 | Critical | 9.8 | 2021-06-24 | CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php. |
CVE-2020-25466 | Critical | 9.8 | 2020-10-23 | A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitra… |