CVE-2026-23698 | High | 7.2 | 2026-07-07 | Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attac… |
CVE-2026-23697 | High | 8.8 | 2026-07-07 | Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .p… |
CVE-2025-45753 | High | 7.2 | 2025-05-21 | A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import fu… |
CVE-2025-45755 | Medium | 6.1 | 2025-05-21 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can… |
CVE-2025-1618 | Medium | 4.3 | 2025-02-24 | A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/ind… |
CVE-2024-54687 | Medium | 6.1 | 2025-01-10 | Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php. |
CVE-2024-48119 | Medium | 5.4 | 2024-10-14 | Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML. |
CVE-2024-44779 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code… |
CVE-2024-44778 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code i… |
CVE-2024-44777 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in t… |
CVE-2024-44776 | Medium | 6.1 | 2024-08-29 | An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL. |
CVE-2024-42995 | High | 8.3 | 2024-08-16 | VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable… |
CVE-2024-42994 | High | 7.2 | 2024-08-16 | VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of t… |
CVE-2023-46304 | High | 8.1 | 2024-04-30 | modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows the… |
CVE-2023-38891 | High | 8.8 | 2023-09-14 | SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportR… |
CVE-2022-38335 | Medium | 5.4 | 2022-09-27 | Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules. |
CVE-2020-22807 | Critical | 9.8 | 2021-04-29 | An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature. |
CVE-2020-19363 | Medium | 6.5 | 2021-01-20 | Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories. |
CVE-2020-19362 | Medium | 6.1 | 2021-01-20 | Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open… |
CVE-2013-3591 | High | 8.8 | 2020-02-07 | vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability |
CVE-2015-6000 | High | 8.8 | 2020-02-06 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtig… |
CVE-2013-3215 | Critical | 9.8 | 2020-01-29 | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. |
CVE-2013-3214 | Critical | 9.8 | 2020-01-28 | vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. |
CVE-2013-3212 | High | 8.1 | 2020-01-28 | vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local s… |
CVE-2019-19202 | High | 8.8 | 2019-11-21 | In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2… |
CVE-2018-8047 | Medium | 6.1 | 2019-06-06 | vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability… |
CVE-2016-10754 | High | 8.8 | 2019-05-24 | modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter. |
CVE-2019-11057 | High | 8.8 | 2019-05-17 | SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. |
CVE-2019-5009 | High | 7.2 | 2019-01-04 | Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size… |
CVE-2016-1713 | High | 7.3 | 2017-04-14 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtig… |
CVE-2016-4834 | High | 8.1 | 2016-08-01 | modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create… |
CVE-2014-2268 | | | 2014-11-16 | views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the… |
CVE-2014-1222 | | | 2014-08-12 | Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files… |
CVE-2014-2269 | | | 2014-04-22 | modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containi… |
CVE-2013-3213 | | | 2014-04-02 | Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name par… |
CVE-2013-7326 | | | 2014-02-14 | Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) return_url parameter to… |
CVE-2013-5091 | | | 2013-10-04 | SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands… |
CVE-2012-4867 | | | 2012-09-06 | Directory traversal vulnerability in modules/com_vtiger_workflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a… |
CVE-2011-4680 | | | 2011-12-07 | Multiple cross-site scripting (XSS) vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or… |
CVE-2011-4679 | | | 2011-12-07 | vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass inten… |
CVE-2011-4670 | | | 2011-12-02 | Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) v… |
CVE-2011-4559 | | | 2011-11-28 | SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuse… |
CVE-2010-3911 | | | 2010-11-26 | Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the userna… |
CVE-2010-3910 | | | 2010-11-26 | Multiple directory traversal vulnerabilities in the return_application_language function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote att… |
CVE-2010-3909 | | | 2010-11-26 | Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the d… |
CVE-2009-3258 | | | 2009-09-18 | vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete (1) attachments, (2) reports, (3) filters, (4) views, and (5… |
CVE-2009-3257 | | | 2009-09-18 | vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Address fields in a pro… |
CVE-2009-3251 | | | 2009-09-18 | include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 allows remote authenticated users to bypass intended access restrictions and read the (1) visibility… |
CVE-2009-3250 | | | 2009-09-18 | The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by compo… |
CVE-2009-3249 | | | 2009-09-18 | Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1)… |
CVE-2009-3248 | | | 2009-09-18 | Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for r… |
CVE-2009-3247 | | | 2009-09-18 | Cross-site scripting (XSS) vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the ac… |
CVE-2008-3101 | | | 2008-09-03 | Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab par… |
CVE-2008-3458 | | | 2008-08-04 | Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge temp… |
CVE-2007-3617 | | | 2007-07-06 | The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitrary private module e… |
CVE-2007-3616 | | | 2007-07-06 | index.php in vtiger CRM before 5.0.3 allows remote authenticated users to perform administrative changes to arbitrary profile settings via a certain profilePri… |
CVE-2007-3604 | | | 2007-07-06 | vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the… |
CVE-2007-3603 | | | 2007-07-06 | SQL injection vulnerability in the dashboard (include/utils/SearchUtils.php) in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary… |
CVE-2007-3602 | | | 2007-07-06 | The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive ac… |
CVE-2007-3601 | | | 2007-07-06 | vtiger CRM before 5.0.3, when a migrated build is used, allows remote authenticated users to read certain other users' calendar activities via a (1) home page… |
CVE-2007-3600 | | | 2007-07-06 | WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge a… |
CVE-2007-3599 | | | 2007-07-06 | vtiger CRM before 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the View permission. |
CVE-2007-3598 | | | 2007-07-06 | index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via… |
CVE-2006-5289 | | | 2006-10-13 | Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the calpath… |
CVE-2006-4617 | | | 2006-09-07 | Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arb… |
CVE-2006-4588 | | | 2006-09-06 | vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php wi… |
CVE-2006-4587 | | | 2006-09-06 | Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML vi… |
CVE-2005-3824 | | | 2005-11-26 | The uploads module in vTiger CRM 4.2 and earlier allows remote attackers to upload arbitrary files, such as PHP files, via the add2db action. |
CVE-2005-3823 | | | 2005-11-26 | The Users module in vTiger CRM 4.2 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which… |
CVE-2005-3822 | | | 2005-11-26 | Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username in the login… |
CVE-2005-3821 | | | 2005-11-26 | Cross-site scripting (XSS) vulnerability in vTiger CRM 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via multiple vectors, inc… |
CVE-2005-3820 | | | 2005-11-26 | Multiple directory traversal vulnerabilities in index.php in vTiger CRM 4.2 and earlier allow remote attackers to read or include arbitrary files, an ultimatel… |
CVE-2005-3819 | | | 2005-11-26 | Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary SQL commands and bypass authentication via the… |
CVE-2005-3818 | | | 2005-11-26 | Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) various… |