CR
Product
CRMEB
34
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 7High 21Medium 6Low 0
Watch
Add CRMEB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-11288 | 8.8 | Oct 5 | CRMEB GET Parameter product sql injection Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; +1 more |
| CVE-2025-10391 | 8.8 | Sep 14 | CRMEB OutAccountServices.php testOutUrl server-side request forgery Affected: through 5.6.1 |
| CVE-2025-10390 | 8.8 | Sep 14 | CRMEB UserAddressServices.php editAddress improper authorization Affected: through 5.6.1 |
| CVE-2025-10389 | 8.8 | Sep 14 | CRMEB Administrator Password SystemAdminServices.php save improper authorization Affected: through 5.6.1 |
| CVE-2024-6943 | 8.8 | Jul 21 | ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization Affected: through 5.4.0 |
| CVE-2023-3233 | 8.8 | Jun 14 | Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery Affected: through 4.6.0 |
| CVE-2020-21394 | 8.8 | Jun 29 | SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php Affected: 2.60; 3.1 |
| CVE-2026-85212 | 8.3 | Sep 3 | CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check Affected: through 6.0.0 |
| CVE-2026-1203 | 8.1 | Jan 20 | CRMEB JSON Token LoginServices.php remoteRegister improper authentication Affected: 5.6.0; 5.6.1; 5.6.2; 5.6.3 |
| CVE-2025-11290 | 8.1 | Oct 5 | CRMEB JWT HMAC Secret hard-coded key Affected: 5.6.0; 5.6.1 |
| CVE-2024-1704 | 8.1 | Feb 21 | ZhongBangKeJi CRMEB crud delete path traversal Affected: 5.2.2 |
| CVE-2024-52726 | 7.5 | Nov 22 | CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information Affected: 5.4.0 |
| CVE-2024-50653 | 7.5 | Nov 15 | CRMEB <=5.4.0 is vulnerable to Incorrect Access Control Affected: through 5.4.0 |
| CVE-2024-6944 | 7.5 | Jul 21 | ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization Affected: through 5.4.0 |
| CVE-2024-36837 | 7.5 | Jun 5 | SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file Affected: 5.2.2 |
| CVE-2022-44343 | 7.5 | Feb 6 | CRMEB 4.4.4 is vulnerable to Any File download Affected: 4.4.4 |
| CVE-2025-15443 | 7.2 | Jan 4 | CRMEB product_export sql injection Affected: 5.6.0; 5.6.1 |
| CVE-2025-15442 | 7.2 | Jan 4 | CRMEB product_list sql injection Affected: 5.6.0; 5.6.1 |
| CVE-2023-2419 | 7.2 | Apr 29 | Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload Affected: 4.6.0 |
| CVE-2023-1165 | 7.2 | Mar 3 | Zhong Bang CRMEB Java list sql injection Affected: 1.3.4 |
| CVE-2026-111359 | 7.1 | Oct 15 | CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift Affected: 5.6.1 through 6.0.0 |
Showing 21