CVE-2026-31845 | Critical | 9.3 | 2026-04-11 | A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarm… |
CVE-2023-53913 | High | 8.8 | 2025-12-17 | Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can c… |
CVE-2023-53898 | Medium | 5.4 | 2025-12-16 | Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert i… |
CVE-2023-53897 | Medium | 5.4 | 2025-12-16 | Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can i… |
CVE-2024-34469 | High | 7.1 | 2024-05-04 | Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save. |
CVE-2024-34468 | Medium | 6.1 | 2024-05-04 | Rukovoditel before 3.5.3 allows XSS via user_photo to My Page. |
CVE-2022-48175 | Critical | 9.8 | 2023-01-30 | Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request. |
CVE-2022-45020 | High | 8.8 | 2022-12-05 | Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. T… |
CVE-2022-44952 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerabili… |
CVE-2022-44951 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/f… |
CVE-2022-44950 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fiel… |
CVE-2022-44949 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fiel… |
CVE-2022-44948 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entit… |
CVE-2022-44947 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listi… |
CVE-2022-44946 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&e… |
CVE-2022-44945 | Critical | 9.8 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter. |
CVE-2022-44944 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages… |
CVE-2022-43288 | High | 8.8 | 2022-11-14 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php. |
CVE-2022-43170 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 all… |
CVE-2022-43169 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows… |
CVE-2022-43168 | Critical | 9.8 | 2022-10-28 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter. |
CVE-2022-43167 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authen… |
CVE-2022-43166 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticat… |
CVE-2022-43165 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticat… |
CVE-2022-43164 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated… |
CVE-2022-43185 | Medium | 5.4 | 2022-10-19 | A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts… |
CVE-2020-13590 | High | 7.2 | 2022-04-18 | Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTT… |
CVE-2020-18470 | Medium | 5.4 | 2021-08-26 | Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4.1 allows remote att… |
CVE-2020-18469 | Medium | 5.4 | 2021-08-26 | Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 all… |
CVE-2020-13589 | High | 8.8 | 2021-08-17 | An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entities_id parameter in t… |
CVE-2020-13588 | High | 8.8 | 2021-08-17 | An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The heading_field_id parameter… |
CVE-2020-35987 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web s… |
CVE-2020-35986 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary… |
CVE-2020-35985 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web sc… |
CVE-2020-35984 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web sc… |
CVE-2021-30224 | High | 8.8 | 2021-04-29 | Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials. |
CVE-2020-13592 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP requ… |
CVE-2020-13591 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HT… |
CVE-2020-13587 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2. A specially crafted H… |
CVE-2020-21732 | Medium | 6.1 | 2020-09-14 | Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code to the filename. |
CVE-2020-11822 | Medium | 6.1 | 2020-04-27 | In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --> user access groups page. Thus, an attacker can inject malicious scri… |
CVE-2020-11821 | Medium | 5.3 | 2020-04-27 | In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply… |
CVE-2020-11817 | Critical | 9.8 | 2020-04-27 | In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the content-type value. As a result of that, an attacker can exec… |
CVE-2020-11820 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities_id parameter. |
CVE-2020-11819 | Critical | 9.8 | 2020-04-16 | In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution. |
CVE-2020-11818 | High | 8.8 | 2020-04-16 | In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, a… |
CVE-2020-11816 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports_id (POST) parameter. |
CVE-2020-11815 | Critical | 9.8 | 2020-04-16 | In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a… |
CVE-2020-11813 | Medium | 5.4 | 2020-04-16 | In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious scri… |
CVE-2020-11812 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters[0][value] or filters[1][value] parameter. |
CVE-2019-7541 | Medium | 6.1 | 2019-05-07 | Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring. |
CVE-2019-7400 | Medium | 6.1 | 2019-02-05 | Rukovoditel before 2.4.1 allows XSS. |
CVE-2018-20166 | High | 8.8 | 2019-01-02 | A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles exten… |