72Crm
Monthly
Cross-site request forgery in WuKongOpenSource WukongCRM 9.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability exists in the AdminRoleController.java file and can be triggered remotely with user interaction. A public exploit is available, but no active exploitation has been reported.
Stored cross-site scripting in WukongCRM 9.0 allows authenticated attackers to inject arbitrary web scripts via the file upload functionality in AdminSysConfigController.java. An attacker with low privileges can upload a malicious file, which executes in the context of a victim user who views it, potentially leading to session hijacking or defacement. A public exploit is available, but the vendor has not responded.
72crm 9.0 has an Arbitrary file upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 72crm 9.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site request forgery in WuKongOpenSource WukongCRM 9.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability exists in the AdminRoleController.java file and can be triggered remotely with user interaction. A public exploit is available, but no active exploitation has been reported.
Stored cross-site scripting in WukongCRM 9.0 allows authenticated attackers to inject arbitrary web scripts via the file upload functionality in AdminSysConfigController.java. An attacker with low privileges can upload a malicious file, which executes in the context of a victim user who views it, potentially leading to session hijacking or defacement. A public exploit is available, but the vendor has not responded.
72crm 9.0 has an Arbitrary file upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 72crm 9.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.