CR
Product
CRMEB
34
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 7High 21Medium 6Low 0
Watch
Add CRMEB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1202 | 9.8 | Jan 20 | CRMEB LoginController.php appleLogin improper authentication Affected: 5.6.0; 5.6.1; 5.6.2; 5.6.3 |
| CVE-2025-25763 | 9.8 | Mar 6 | crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php Affected: 5.4.0 |
| CVE-2023-3234 | 9.8 | Jun 14 | Zhong Bang CRMEB PublicController.php put_image deserialization Affected: through 4.6.0 |
| CVE-2023-3232 | 9.8 | Jun 14 | Zhong Bang CRMEB Image Upload app_auth deserialization Affected: through 4.6.0 |
| CVE-2023-30185 | 9.8 | May 8 | CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php Affected: 4.4.0 through 4.6.0 |
| CVE-2020-21787 | 9.8 | Jun 24 | CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php Affected: 3.1.0+ |
| CVE-2020-25466 | 9.8 | Oct 23 | A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code Affected: 3.0 |
| CVE-2025-11288 | 8.8 | Oct 5 | CRMEB GET Parameter product sql injection Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; +1 more |
| CVE-2025-10391 | 8.8 | Sep 14 | CRMEB OutAccountServices.php testOutUrl server-side request forgery Affected: through 5.6.1 |
| CVE-2025-10390 | 8.8 | Sep 14 | CRMEB UserAddressServices.php editAddress improper authorization Affected: through 5.6.1 |
| CVE-2025-10389 | 8.8 | Sep 14 | CRMEB Administrator Password SystemAdminServices.php save improper authorization Affected: through 5.6.1 |
| CVE-2024-6943 | 8.8 | Jul 21 | ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization Affected: through 5.4.0 |
| CVE-2023-3233 | 8.8 | Jun 14 | Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery Affected: through 4.6.0 |
| CVE-2020-21394 | 8.8 | Jun 29 | SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php Affected: 2.60; 3.1 |
| CVE-2026-85212 | 8.3 | Sep 3 | CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check Affected: through 6.0.0 |
| CVE-2026-1203 | 8.1 | Jan 20 | CRMEB JSON Token LoginServices.php remoteRegister improper authentication Affected: 5.6.0; 5.6.1; 5.6.2; 5.6.3 |
| CVE-2025-11290 | 8.1 | Oct 5 | CRMEB JWT HMAC Secret hard-coded key Affected: 5.6.0; 5.6.1 |
| CVE-2024-1704 | 8.1 | Feb 21 | ZhongBangKeJi CRMEB crud delete path traversal Affected: 5.2.2 |
| CVE-2024-52726 | 7.5 | Nov 22 | CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information Affected: 5.4.0 |
| CVE-2024-50653 | 7.5 | Nov 15 | CRMEB <=5.4.0 is vulnerable to Incorrect Access Control Affected: through 5.4.0 |
| CVE-2024-6944 | 7.5 | Jul 21 | ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization Affected: through 5.4.0 |
| CVE-2024-36837 | 7.5 | Jun 5 | SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file Affected: 5.2.2 |
| CVE-2022-44343 | 7.5 | Feb 6 | CRMEB 4.4.4 is vulnerable to Any File download Affected: 4.4.4 |
| CVE-2025-15443 | 7.2 | Jan 4 | CRMEB product_export sql injection Affected: 5.6.0; 5.6.1 |
| CVE-2025-15442 | 7.2 | Jan 4 | CRMEB product_list sql injection Affected: 5.6.0; 5.6.1 |
| CVE-2023-2419 | 7.2 | Apr 29 | Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload Affected: 4.6.0 |
| CVE-2023-1165 | 7.2 | Mar 3 | Zhong Bang CRMEB Java list sql injection Affected: 1.3.4 |
| CVE-2026-111359 | 7.1 | Oct 15 | CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift Affected: 5.6.1 through 6.0.0 |
| CVE-2026-85177 | 5.4 | Sep 3 | CRMEB through 6.0.0 Unauthorized Message Modification via edit_message Affected: through 6.0.0 |
| CVE-2026-1734 | 5.3 | Feb 1 | Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization Affected: 5.6.0; 5.6.1; 5.6.2; 5.6.3 |
| CVE-2024-1703 | 5.3 | Feb 21 | ZhongBangKeJi CRMEB openfile absolute path traversal Affected: 5.2.2 |
| CVE-2026-85040 | 4.7 | Sep 3 | ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection Affected: 6.0 |
| CVE-2026-1733 | 4.3 | Feb 1 | Zhong Bang CRMEB :uni tidyOrder improper authorization Affected: 5.6.0; 5.6.1; 5.6.2; 5.6.3 |
| CVE-2020-21788 | 4.3 | Jun 24 | In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery) Affected: 3.1.0+ |
Showing 34