Login Request a demo
CR
Vendor
crmeb
2 products with CVEs on record
43
CVEs
0
On KEV
2
New 30D
Products
CR
CRMEB
crmeb
9.8
34 CVEs0 on KEV1 new
CR
crmeb_java
crmeb
9.8
9 CVEs0 on KEV1 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-111359
CR
CRMEB
crmeb
7.1
0%
Oct 15CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
CVE-2026-111354
CR
crmeb_java
crmeb
3.1
0%
Oct 15crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
CVE-2026-85212
CR
CRMEB
crmeb
8.3
1%
Sep 3CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check
CVE-2026-85177
CR
CRMEB
crmeb
5.4
0%
Sep 3CRMEB through 6.0.0 Unauthorized Message Modification via edit_message
CVE-2026-85040
CR
CRMEB
ZhongBangKeJi
4.7
2%
Sep 3ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection
CVE-2026-10771
CR
crmeb_java
crmeb
7.3
0%
Jun 3crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery
CVE-2026-1734
CR
CRMEB
Zhong Bang
5.3
1%
Feb 1Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization
CVE-2026-1733
CR
CRMEB
Zhong Bang
4.3
0%
Feb 1Zhong Bang CRMEB :uni tidyOrder improper authorization
CVE-2026-1203
CR
CRMEB
Crmeb
8.1
1%
Jan 20CRMEB JSON Token LoginServices.php remoteRegister improper authentication
CVE-2026-1202
CR
CRMEB
Crmeb
9.8
1%
Jan 20CRMEB LoginController.php appleLogin improper authentication
CVE-2025-15443
CR
CRMEB
Crmeb
7.2
0%
Jan 4CRMEB product_export sql injection
CVE-2025-15442
CR
CRMEB
Crmeb
7.2
0%
Jan 4CRMEB product_list sql injection
CVE-2025-11290
CR
CRMEB
Crmeb
8.1
0%
Oct 5CRMEB JWT HMAC Secret hard-coded key
CVE-2025-11288
CR
CRMEB
Crmeb
8.8
0%
Oct 5CRMEB GET Parameter product sql injection
CVE-2025-10391
CR
Crmeb
Crmeb
8.8
0%
Sep 14CRMEB OutAccountServices.php testOutUrl server-side request forgery
CVE-2025-10390
CR
Crmeb
Crmeb
8.8
0%
Sep 14CRMEB UserAddressServices.php editAddress improper authorization
CVE-2025-10389
CR
Crmeb
Crmeb
8.8
0%
Sep 14CRMEB Administrator Password SystemAdminServices.php save improper authorization
CVE-2025-25763
CR
Crmeb
Crmeb
9.8
1%
Mar 6crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
CVE-2024-52726
CR
Crmeb
Crmeb
7.5
2%
Nov 22CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information
CVE-2024-50653
CR
Crmeb
Crmeb
7.5
1%
Nov 15CRMEB <=5.4.0 is vulnerable to Incorrect Access Control
CVE-2024-6944
CR
Crmeb
Crmeb
7.5
4%
Jul 21ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization
CVE-2024-6943
CR
Crmeb
Crmeb
8.8
1%
Jul 21ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization
CVE-2024-36837
CR
Crmeb
Crmeb
7.5
8%
Jun 5SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file
CVE-2024-33117
CJ
Crmeb Java
Crmeb
5.3
0%
May 6crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController
CVE-2024-28714
CJ
Crmeb Java
Crmeb
8.1
1%
Mar 28SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter
CVE-2024-24110
CJ
Crmeb Java
Crmeb
6.5
1%
Feb 29SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spread/people
CVE-2024-25469
CJ
Crmeb Java
Crmeb
7.5
1%
Feb 23SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude parameters in the…
CVE-2024-1704
CR
Crmeb
Crmeb
8.1
1%
Feb 21ZhongBangKeJi CRMEB crud delete path traversal
CVE-2024-1703
CR
Crmeb
Crmeb
5.3
1%
Feb 21ZhongBangKeJi CRMEB openfile absolute path traversal
CVE-2023-3234
CR
Crmeb
Crmeb
9.8
1%
Jun 14Zhong Bang CRMEB PublicController.php put_image deserialization
CVE-2023-3233
CR
Crmeb
Crmeb
8.8
1%
Jun 14Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery
CVE-2023-3232
CR
Crmeb
Crmeb
9.8
1%
Jun 14Zhong Bang CRMEB Image Upload app_auth deserialization
CVE-2023-30185
CR
Crmeb
Crmeb
9.8
1%
May 8CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php
CVE-2023-2419
CR
Crmeb
Crmeb
7.2
1%
Apr 29Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload
CVE-2023-1609
CJ
Crmeb Java
Crmeb
5.4
1%
Mar 23Zhong Bang CRMEB Java save cross site scripting
CVE-2023-1608
CJ
Crmeb Java
Crmeb
9.8
1%
Mar 23Zhong Bang CRMEB Java list getAdminList sql injection
CVE-2023-25223
CJ
Crmeb Java
Crmeb
7.2
1%
Mar 7CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list
CVE-2023-1165
CR
Crmeb
Crmeb
7.2
1%
Mar 3Zhong Bang CRMEB Java list sql injection
CVE-2022-44343
CR
Crmeb
Crmeb
7.5
1%
Feb 6CRMEB 4.4.4 is vulnerable to Any File download
CVE-2020-21394
CR
Crmeb
Crmeb
8.8
1%
Jun 29SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php
CVE-2020-21788
CR
Crmeb
Crmeb
4.3
1%
Jun 24In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery)
CVE-2020-21787
CR
Crmeb
Crmeb
9.8
2%
Jun 24CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php
CVE-2020-25466
CR
Crmeb
Crmeb
9.8
3%
Oct 23A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code