EUVD-2026-71770
GHSA-r4hr-pfjj-9xhg
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Admin credentials required (PR:H); file deletion yields no confidentiality impact (C:N); integrity and availability fully compromised via arbitrary deletion.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request.
AnalysisAI
Arbitrary file deletion in CRMEB v6.0.0 permits authenticated administrators to erase files at arbitrary server-side paths by sending a crafted POST request to the /adminapi/file/video_data_save endpoint. The CWE-73 (External Control of File Name or Path) root cause indicates the endpoint passes attacker-controlled path values directly to filesystem operations without path confinement or canonicalization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid CRMEB administrator-level credentials, as stated explicitly in the CVE description ('authenticated attackers') and reflected in the PR:H metric of the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.2 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is partially overstated: the C:H metric is inconsistent with a pure file deletion primitive, which does not inherently expose confidential data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch with a specific fix version has been identified in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all CRMEB administrative accounts for unauthorized access and disable unused admin credentials; review access logs to the /adminapi/file/video_data_save endpoint for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. Rated critical severity (CVSS 9.8), this vulnerability is rem
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. Rated critical severity (CVSS 9.8)
A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. Rated critical severity (CVSS 9.8), this vulnerability i
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. Rated high severity (CVSS 8.8), this vulnerability is remotel
SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the
A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. Rated high severity (CVSS 8.1), this vulnerability is no authent
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Rated high severity (CVSS 7.5), this vulnerability is remotely
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProduct
SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive informat
A vulnerability was found in Zhong Bang CRMEB 4.6.0. Rated high severity (CVSS 7.2), this vulnerability is remotely expl
CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list. Rated high severity (CVSS 7.2), this vulnerabilit
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today