← Back

Vtiger Crm

vtiger_crm

Vendor: Vtiger • 72 CVEs

CVEs (72)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-45753
1Vtiger
1Vtiger Crm
Jun 17, 2026
May 21, 2025
N/A· v4
7.2 HIGH· v3
N/A· v2
A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature.
CVE-2025-45755
1Vtiger
1Vtiger Crm
Jun 17, 2026
May 21, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped...Show more
A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped to the Service Name field. When the file is uploaded, the application improperly sanitizes user input, leading to persistent script execution.Show less
CVE-2025-1618
1Vtiger
1Vtiger Crm
Jun 17, 2026
Feb 24, 2025
5.3 MEDIUM· v4
6.1 MEDIUM· v3
5.0 MEDIUM· v2
A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to...Show more
A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2024-54687
1Vtiger
1Vtiger Crm
Jun 17, 2026
Jan 10, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.
CVE-2024-48119
1Vtiger
1Vtiger Crm
Jun 17, 2026
Oct 14, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML.
CVE-2024-44779
1Vtiger
1Vtiger Crm
Jul 5, 2026
Aug 29, 2024
N/A· v4
9.6 CRITICAL· v3
N/A· v2
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted p...Show more
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.Show less
CVE-2024-44778
1Vtiger
1Vtiger Crm
Jul 5, 2026
Aug 29, 2024
N/A· v4
9.6 CRITICAL· v3
N/A· v2
A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted pay...Show more
A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.Show less
CVE-2024-44777
1Vtiger
1Vtiger Crm
Jul 5, 2026
Aug 29, 2024
N/A· v4
9.6 CRITICAL· v3
N/A· v2
A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payloa...Show more
A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.Show less
CVE-2024-44776
1Vtiger
1Vtiger Crm
Jul 5, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.
CVE-2024-42995
1Vtiger
1Vtiger Crm
Jun 17, 2026
Aug 16, 2024
N/A· v4
8.3 HIGH· v3
N/A· v2
VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules.
CVE-2024-42994
1Vtiger
1Vtiger Crm
Jun 17, 2026
Aug 16, 2024
N/A· v4
7.2 HIGH· v3
N/A· v2
VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module.
CVE-2023-46304
1Vtiger
1Vtiger Crm
Jun 17, 2026
Apr 30, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on...Show more
modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).Show less
CVE-2023-38891
1Vtiger
1Vtiger Crm
Jun 17, 2026
Sep 14, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php.
CVE-2022-38335
1Vtiger
1Vtiger Crm
Jun 17, 2026
Sep 27, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.
CVE-2020-22807
1Vtiger
1Vtiger Crm
Jun 17, 2026
Apr 29, 2021
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature.
CVE-2020-19363
1Vtiger
1Vtiger Crm
Jun 17, 2026
Jan 20, 2021
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.
CVE-2020-19362
1Vtiger
1Vtiger Crm
Jun 17, 2026
Jan 20, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page.
CVE-2013-3591
1Vtiger
1Vtiger Crm
Nov 21, 2024
Feb 7, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability
CVE-2015-6000
1Vtiger
1Vtiger Crm
Nov 21, 2024
Feb 6, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to...Show more
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.Show less
CVE-2013-3215
1Vtiger
1Vtiger Crm
Nov 21, 2024
Jan 29, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.