Fatfreecrm
8 CVEs across 2 Fatfreecrm products. Browse Fatfreecrm vulnerabilities, severities, and proof-of-concept exploits.
Fatfreecrm products with known CVEs
Fatfreecrm CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2022-39281 | Medium | 6.5 | 2022-10-08 | fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform… |
CVE-2018-20975 | Medium | 6.1 | 2019-08-20 | Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb. |
CVE-2019-10226 | Medium | 5.4 | 2019-06-10 | HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor dispu… |
CVE-2018-1000842 | Medium | 6.1 | 2018-12-20 | FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d… |
CVE-2015-1585 | | | 2015-02-19 | Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demons… |
CVE-2014-5441 | | | 2014-09-12 | Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject a… |
CVE-2013-7249 | | | 2014-01-02 | Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstr… |
CVE-2013-7225 | | | 2014-01-02 | Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrar… |
CVE-2013-7224 | | | 2014-01-02 | Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonst… |
CVE-2013-7223 | | | 2014-01-02 | Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified vic… |
CVE-2013-7222 | | | 2014-01-02 | config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remo… |