EUVD-2026-59907
GHSA-w5gq-mqrx-5j28
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable search input, but PR:L because authenticated access to the Customer Search Module is required; no scope change as impact stays within the application process.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project confirms, that "it’s being processed".
AnalysisAI
Stack-based buffer overflow in DefaultFuction's Customer-Relationship-Management-In-C-Project 2.0 exposes authenticated remote attackers to arbitrary code execution or application crash by supplying oversized input to the Customer Search Module's unsafe gets() call. A public proof-of-concept exploit is available on GitHub, and the project maintainer has acknowledged the issue is only 'being processed,' meaning no patch has been released. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with the CRM application at the level of a standard user capable of accessing the Customer Search Module (CVSS PR:L) - unauthenticated network attackers cannot reach the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) reflects network-accessible exploitation (AV:N), low complexity (AC:L), no special attack requirements (AT:N), but a low-privilege authentication barrier (PR:L) that prevents unauthenticated abuse. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the maintainer confirmed the issue is 'being processed.' The definitive fix is replacing the unsafe `gets()` call with `fgets(buffer, sizeof(buffer), stdin)` or `scanf("%Ns", buffer)` with an explicit field width matching the buffer size - this eliminates the overflow primitive entirely and should be applied to the Customer Search Module source before the next release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today