Skip to content
Noroxi

crmeb records

37 published records for vendor crmeb.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 20
  2. 21
  3. 23
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

37 records
  • CVE-2020-25466
    40Plan

    A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remot

    CriticalCVSS 9.8No exploitEPSS 2%

    crmeb · crmebOct 23, 2020

  • CVE-2020-21787
    40Plan

    CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    crmeb · crmebJun 24, 2021

  • CVE-2023-3232
    39Monitor

    Zhong Bang CRMEB Image Upload app_auth deserialization

    CriticalCVSS 9.8No exploitEPSS 1%

    crmeb · crmebJun 14, 2023

  • CVE-2023-3234
    39Monitor

    Zhong Bang CRMEB PublicController.php put_image deserialization

    CriticalCVSS 9.8No exploitEPSS 1%

    crmeb · crmebJun 14, 2023

  • CVE-2023-30185
    39Monitor

    CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.p

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    crmeb · crmebMay 7, 2023

  • CVE-2025-25763
    39Monitor

    crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    crmeb · crmebMar 6, 2025

  • CVE-2023-1608
    39Monitor

    Zhong Bang CRMEB Java list getAdminList sql injection

    CriticalCVSS 9.8No exploitEPSS 0%

    crmeb · crmeb javaMar 23, 2023

  • CVE-2020-21394
    35Monitor

    SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDataback

    HighCVSS 8.8No exploitEPSS 1%

    crmeb · crmebJun 29, 2021

  • CVE-2023-3233
    35Monitor

    Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery

    HighCVSS 8.8No exploitEPSS 0%

    crmeb · crmebJun 14, 2023

  • CVE-2024-36837
    32Monitor

    SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the

    HighCVSS 7.5Proof of conceptEPSS 8%

    crmeb · crmebJun 5, 2024

  • CVE-2024-28714
    32Monitor

    SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.

    HighCVSS 8.1No exploitEPSS 0%

    crmeb · crmeb javaMar 28, 2024

  • CVE-2024-1704
    32Monitor

    ZhongBangKeJi CRMEB crud delete path traversal

    HighCVSS 8.1No exploitEPSS 0%

    crmeb · crmebFeb 21, 2024

  • CVE-2024-52726
    31Monitor

    CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information

    HighCVSS 7.5No exploitEPSS 1%

    crmeb · crmebNov 22, 2024

  • CVE-2024-25469
    30Monitor

    SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude

    HighCVSS 7.5No exploitEPSS 0%

    crmeb · crmeb javaFeb 23, 2024

  • CVE-2022-44343
    30Monitor

    CRMEB 4.4.4 is vulnerable to Any File download.

    HighCVSS 7.5No exploitEPSS 0%

    crmeb · crmebFeb 6, 2023

  • CVE-2024-50653
    30Monitor

    CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.

    HighCVSS 7.5No exploitEPSS 0%

    crmeb · crmebNov 15, 2024

  • CVE-2023-2419
    28Monitor

    Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload

    HighCVSS 7.2No exploitEPSS 0%

    crmeb · crmebApr 28, 2023

  • CVE-2023-1165
    28Monitor

    Zhong Bang CRMEB Java list sql injection

    HighCVSS 7.2No exploitEPSS 0%

    crmeb · crmebMar 3, 2023

  • CVE-2023-25223
    28Monitor

    CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.

    HighCVSS 7.2No exploitEPSS 0%

    crmeb · crmeb javaMar 7, 2023

  • CVE-2024-24110
    26Monitor

    SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the compon

    MediumCVSS 6.5No exploitEPSS 0%

    crmeb · crmeb javaMar 20, 2024

  • CVE-2024-6944
    22Monitor

    ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization

    MediumCVSS 5.3No exploitEPSS 3%

    crmeb · crmebJul 21, 2024

  • CVE-2026-1202
    22Monitor

    CRMEB LoginController.php appleLogin improper authentication

    MediumCVSS 5.5No exploitEPSS 0%

    crmeb · crmebJan 19, 2026

  • CVE-2026-1734
    22Monitor

    Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization

    MediumCVSS 5.5No exploitEPSS 0%

    crmeb · crmebFeb 1, 2026

  • CVE-2024-1703
    21Monitor

    ZhongBangKeJi CRMEB openfile absolute path traversal

    MediumCVSS 5.3No exploitEPSS 0%

    crmeb · crmebFeb 21, 2024

  • CVE-2024-6943
    21Monitor

    ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization

    MediumCVSS 5.3No exploitEPSS 0%

    crmeb · crmebJul 21, 2024