Skip to content
Threat Feed
Subscribe

Vendor

CRMEB

2 briefs RSS
high advisory

Insecure Direct Object Reference in CRMEB gift-order API

CRMEB versions 5.6.1 through 6.0.0 contain an IDOR vulnerability allowing authenticated attackers to enumerate and hijack order details via the gift-order API.

CRMEB
2t 1c
high advisory

Authentication Bypass in CRMEB via SystemRoleServices.php

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php, allowing unprivileged accounts to access restricted administrative endpoints.

CRMEB authentication-bypass web-application
1c