Vendor
high
advisory
Metasoft MetaCRM SQL Injection Vulnerability (CVE-2026-15514)
1 rule 1 TTP 1 CVEA critical SQL injection vulnerability (CVE-2026-15514) in Metasoft MetaCRM up to version 6.4.0 Beta06 allows remote attackers to exploit the RPCService.query function via the phprpc_args argument in /customizemt/xkq/rpc.jsp, leading to unauthorized database access and manipulation, with a public exploit available.
MetaCRM up to 6.4.0 Beta06
sql-injection
web-vulnerability
crm
remote-code-execution
1r
1t
1c
high
threat
Metasoft MetaCRM Unrestricted File Upload Vulnerability (CVE-2026-8758)
2 rules 1 TTP 1 CVEA vulnerability in Metasoft MetaCRM up to version 6.4.0 Beta06 allows for unrestricted file upload due to manipulation of the 'File' argument in the /common/jsp/upload3.jsp file, potentially leading to arbitrary code execution.
exploited
MetaCRM
unrestricted-upload
rce
web-application
2r
1t
1c