Xrms Crm

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2014-5520 HIGH POC This Week

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the user_id parameter to plugins/webform/new-form.php, which is not properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

PHP SQLi Xrms Crm

NVD Exploit-DB

CVSS 2.0

7.5

EPSS

6.0%

CVE-2014-5521 MEDIUM POC This Month

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

RCE PHP SQLi Xrms Crm

NVD Exploit-DB

CVSS 2.0

6.5

EPSS

8.5%

CVE-2014-5520

EPSS 6% CVSS 7.5

HIGH POC This Week

PHP SQLi Xrms Crm

NVD Exploit-DB

CVE-2014-5521

EPSS 9% CVSS 6.5

MEDIUM POC This Month

RCE PHP SQLi +1

NVD Exploit-DB