Csm Customer Service Management
Monthly
Remote code execution in Next4Biz CSM (Customer Service Management) up to build 07092026 allows unauthenticated attackers to inject and execute code by supplying crafted serialized objects that the application deserializes without validation (CWE-502). Reported by Turkey's national CSIRT (TR-CERT/USOM); the vendor was contacted but did not respond, and no fixed build is confirmed. No public exploit identified at time of analysis, and no KEV/EPSS enrichment is available in the provided data.
Unauthenticated path traversal in Next4Biz CSM (Customer Service Management) versions 6.8.9 through 07092026 allows remote attackers to read arbitrary files from the server filesystem with no credentials required. The flaw is classified under CWE-22 and carries a CVSS 3.1 score of 7.5 with a network-accessible, zero-interaction vector, meaning any internet-reachable deployment is potentially exposed to full confidentiality compromise. Disclosed by TR-CERT (Turkish national CERT), the vendor did not respond to the disclosure, and no patch has been confirmed as available at time of analysis.
Remote code execution in Next4Biz CSM (Customer Service Management) up to build 07092026 allows unauthenticated attackers to inject and execute code by supplying crafted serialized objects that the application deserializes without validation (CWE-502). Reported by Turkey's national CSIRT (TR-CERT/USOM); the vendor was contacted but did not respond, and no fixed build is confirmed. No public exploit identified at time of analysis, and no KEV/EPSS enrichment is available in the provided data.
Unauthenticated path traversal in Next4Biz CSM (Customer Service Management) versions 6.8.9 through 07092026 allows remote attackers to read arbitrary files from the server filesystem with no credentials required. The flaw is classified under CWE-22 and carries a CVSS 3.1 score of 7.5 with a network-accessible, zero-interaction vector, meaning any internet-reachable deployment is potentially exposed to full confidentiality compromise. Disclosed by TR-CERT (Turkish national CERT), the vendor did not respond to the disclosure, and no patch has been confirmed as available at time of analysis.