Skip to content
Threat Feed
Subscribe

Tag

Crm

4 briefs RSS
critical advisory

Krayin CRM Installer Authentication Bypass Vulnerability

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware, allowing unauthenticated remote attackers to overwrite the administrator account via crafted HTTP POST requests.

Krayin CRM vulnerability crm authentication-bypass
1r 1t 1c
high advisory

Metasoft MetaCRM SQL Injection Vulnerability (CVE-2026-15514)

A critical SQL injection vulnerability (CVE-2026-15514) in Metasoft MetaCRM up to version 6.4.0 Beta06 allows remote attackers to exploit the RPCService.query function via the phprpc_args argument in /customizemt/xkq/rpc.jsp, leading to unauthorized database access and manipulation, with a public exploit available.

MetaCRM up to 6.4.0 Beta06 sql-injection web-vulnerability crm remote-code-execution
1r 1t 1c
high advisory

Krayin CRM Insecure Direct Object Reference Vulnerability (CVE-2026-61460)

An Insecure Direct Object Reference (IDOR) vulnerability, CVE-2026-61460, in Krayin CRM through version 2.2.3 allows authenticated users to modify, update, or delete records owned by other users by exploiting missing record-level ownership validation in various controllers, leading to unauthorized data manipulation.

Krayin CRM +1 idor crm web-application vulnerability
3t 1c
high advisory

Krayin CRM v2.2.x Authenticated Remote Code Execution Exploit

A public exploit (EDB-52629) has been released for Krayin CRM v2.2.x, demonstrating an authenticated remote code execution vulnerability that allows an authenticated attacker to execute arbitrary code on the underlying system, significantly increasing the risk for unpatched deployments of the web application.

Krayin CRM v2.2.x webapps rce exploit-db krayin-crm crm
1t