TR
Vendor
trainingbusinesspros
16
CVEs
0
On KEV
5
New 30D
Products
GC8.8
Groundhogg — CRM, Newsletters, and Marketing Automation
trainingbusinesspros
15 CVEs0 on KEV5 new
FF5.3
FormLift for Infusionsoft Web Forms
trainingbusinesspros
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109221 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 8.1 | Oct 16 | Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping |
| CVE-2026-18548 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 7.2 | Oct 15 | Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter |
| CVE-2026-92975 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 8.1 | Oct 10 | Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion |
| CVE-2026-104725 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 8.8 | Oct 10 | Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter |
| CVE-2026-97644 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 8.8 | Oct 3 | Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test |
| CVE-2026-18387 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 6.5 | Aug 15 | Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter |
| CVE-2026-11454 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 6.5 | Aug 5 | Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference |
| CVE-2026-14029 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 6.5 | Jul 2 | Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter |
| CVE-2026-13333 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 6.5 | Jun 27 | Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter |
| CVE-2026-13331 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 6.5 | Jun 27 | Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter |
| CVE-2026-13226 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 6.5 | Jun 26 | Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter |
| CVE-2026-4281 | FF FormLift for Infusionsoft Web Forms trainingbusinesspros | 5.3 | Mar 26 | FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow |
| CVE-2025-12750 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 4.9 | Nov 21 | Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection |
| CVE-2025-4206 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 7.2 | May 9 | WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion |
| CVE-2025-1267 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 5.5 | Apr 1 | Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter |
| CVE-2025-0394 | GC Groundhogg — CRM, Newsletters, and Marketing Automation trainingbusinesspros | 8.8 | Jan 14 | Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function |