crmeb kayıtları
crmeb üreticisine ait 37 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %0
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')9
- CWE-918 Server-Side Request Forgery (SSRF)5
- CWE-502 Deserialization of Untrusted Data4
- CWE-434 Unrestricted Upload of File with Dangerous Type3
- CWE-266 Incorrect Privilege Assignment3
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')3
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
37 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
40Planlayın | CVE-2020-25466İstismar yok | A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotcrmeb · crmeb · CWE-918 | Kritik9,8 | — | %2,5 | 23 Eki 2020 |
40Planlayın | CVE-2020-21787İstismar yok | CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.crmeb · crmeb · CWE-434 | Kritik9,8 | — | %1,8 | 24 Haz 2021 |
39İzleyin | CVE-2023-3232İstismar yok | Zhong Bang CRMEB Image Upload app_auth deserializationcrmeb · crmeb · CWE-502 | Kritik9,8 | — | %1,2 | 14 Haz 2023 |
39İzleyin | CVE-2023-3234İstismar yok | Zhong Bang CRMEB PublicController.php put_image deserializationcrmeb · crmeb · CWE-502 | Kritik9,8 | — | %1,1 | 14 Haz 2023 |
39İzleyin | CVE-2023-30185Kavram kanıtı | CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.pcrmeb · crmeb · CWE-434 | Kritik9,8 | — | %1,1 | 7 May 2023 |
39İzleyin | CVE-2025-25763Kavram kanıtı | crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.phpcrmeb · crmeb · CWE-89 | Kritik9,8 | — | %0,9 | 6 Mar 2025 |
39İzleyin | CVE-2023-1608İstismar yok | Zhong Bang CRMEB Java list getAdminList sql injectioncrmeb · crmeb java · CWE-89 | Kritik9,8 | — | %0,6 | 23 Mar 2023 |
35İzleyin | CVE-2020-21394İstismar yok | SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackcrmeb · crmeb · CWE-89 | Yüksek8,8 | — | %1,1 | 29 Haz 2021 |
35İzleyin | CVE-2023-3233İstismar yok | Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgerycrmeb · crmeb · CWE-918 | Yüksek8,8 | — | %0,8 | 14 Haz 2023 |
32İzleyin | CVE-2024-36837Kavram kanıtı | SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in thecrmeb · crmeb · CWE-89 | Yüksek7,5 | — | %8,3 | 5 Haz 2024 |
32İzleyin | CVE-2024-28714İstismar yok | SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.crmeb · crmeb java · CWE-89 | Yüksek8,1 | — | %0,8 | 28 Mar 2024 |
32İzleyin | CVE-2024-1704İstismar yok | ZhongBangKeJi CRMEB crud delete path traversalcrmeb · crmeb · CWE-22 | Yüksek8,1 | — | %0,6 | 21 Şub 2024 |
31İzleyin | CVE-2024-52726İstismar yok | CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive informationcrmeb · crmeb · CWE-125 | Yüksek7,5 | — | %1,7 | 22 Kas 2024 |
30İzleyin | CVE-2024-25469İstismar yok | SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitudecrmeb · crmeb java · CWE-89 | Yüksek7,5 | — | %0,7 | 23 Şub 2024 |
30İzleyin | CVE-2022-44343İstismar yok | CRMEB 4.4.4 is vulnerable to Any File download.crmeb · crmeb · CWE-552 | Yüksek7,5 | — | %0,6 | 6 Şub 2023 |
30İzleyin | CVE-2024-50653İstismar yok | CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.crmeb · crmeb · CWE-284 | Yüksek7,5 | — | %0,5 | 15 Kas 2024 |
28İzleyin | CVE-2023-2419İstismar yok | Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted uploadcrmeb · crmeb · CWE-434 | Yüksek7,2 | — | %0,8 | 28 Nis 2023 |
28İzleyin | CVE-2023-1165İstismar yok | Zhong Bang CRMEB Java list sql injectioncrmeb · crmeb · CWE-89 | Yüksek7,2 | — | %0,7 | 3 Mar 2023 |
28İzleyin | CVE-2023-25223İstismar yok | CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.crmeb · crmeb java · CWE-89 | Yüksek7,2 | — | %0,7 | 7 Mar 2023 |
26İzleyin | CVE-2024-24110İstismar yok | SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the componcrmeb · crmeb java · CWE-89 | Orta6,5 | — | %0,6 | 20 Mar 2024 |
22İzleyin | CVE-2024-6944İstismar yok | ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserializationcrmeb · crmeb · CWE-502 | Orta5,3 | — | %3,7 | 21 Tem 2024 |
22İzleyin | CVE-2026-1202İstismar yok | CRMEB LoginController.php appleLogin improper authenticationcrmeb · crmeb · CWE-287 | Orta5,5 | — | %0,9 | 19 Oca 2026 |
22İzleyin | CVE-2026-1734İstismar yok | Zhong Bang CRMEB crontab Endpoint CrontabController.php authorizationcrmeb · crmeb · CWE-862 | Orta5,5 | — | %0,5 | 1 Şub 2026 |
21İzleyin | CVE-2024-1703İstismar yok | ZhongBangKeJi CRMEB openfile absolute path traversalcrmeb · crmeb · CWE-36 | Orta5,3 | — | %0,7 | 21 Şub 2024 |
21İzleyin | CVE-2024-6943İstismar yok | ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserializationcrmeb · crmeb · CWE-502 | Orta5,3 | — | %0,6 | 21 Tem 2024 |
- CVE-2020-2546640Planlayın
A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remot
KritikCVSS 9,8İstismar yokEPSS %2crmeb · crmeb23 Eki 2020
- CVE-2020-2178740Planlayın
CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
KritikCVSS 9,8İstismar yokEPSS %1crmeb · crmeb24 Haz 2021
- CVE-2023-323239İzleyin
Zhong Bang CRMEB Image Upload app_auth deserialization
KritikCVSS 9,8İstismar yokEPSS %1crmeb · crmeb14 Haz 2023
- CVE-2023-323439İzleyin
Zhong Bang CRMEB PublicController.php put_image deserialization
KritikCVSS 9,8İstismar yokEPSS %1crmeb · crmeb14 Haz 2023
- CVE-2023-3018539İzleyin
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.p
KritikCVSS 9,8Kavram kanıtıEPSS %1crmeb · crmeb7 May 2023
- CVE-2025-2576339İzleyin
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
KritikCVSS 9,8Kavram kanıtıEPSS %0crmeb · crmeb6 Mar 2025
- CVE-2023-160839İzleyin
Zhong Bang CRMEB Java list getAdminList sql injection
KritikCVSS 9,8İstismar yokEPSS %0crmeb · crmeb java23 Mar 2023
- CVE-2020-2139435İzleyin
SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDataback
YüksekCVSS 8,8İstismar yokEPSS %1crmeb · crmeb29 Haz 2021
- CVE-2023-323335İzleyin
Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery
YüksekCVSS 8,8İstismar yokEPSS %0crmeb · crmeb14 Haz 2023
- CVE-2024-3683732İzleyin
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the
YüksekCVSS 7,5Kavram kanıtıEPSS %8crmeb · crmeb5 Haz 2024
- CVE-2024-2871432İzleyin
SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.
YüksekCVSS 8,1İstismar yokEPSS %0crmeb · crmeb java28 Mar 2024
- CVE-2024-170432İzleyin
ZhongBangKeJi CRMEB crud delete path traversal
YüksekCVSS 8,1İstismar yokEPSS %0crmeb · crmeb21 Şub 2024
- CVE-2024-5272631İzleyin
CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information
YüksekCVSS 7,5İstismar yokEPSS %1crmeb · crmeb22 Kas 2024
- CVE-2024-2546930İzleyin
SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude
YüksekCVSS 7,5İstismar yokEPSS %0crmeb · crmeb java23 Şub 2024
- CVE-2022-4434330İzleyin
CRMEB 4.4.4 is vulnerable to Any File download.
YüksekCVSS 7,5İstismar yokEPSS %0crmeb · crmeb6 Şub 2023
- CVE-2024-5065330İzleyin
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.
YüksekCVSS 7,5İstismar yokEPSS %0crmeb · crmeb15 Kas 2024
- CVE-2023-241928İzleyin
Zhong Bang CRMEB SystemAttachmentServices.php videoUpload unrestricted upload
YüksekCVSS 7,2İstismar yokEPSS %0crmeb · crmeb28 Nis 2023
- CVE-2023-116528İzleyin
Zhong Bang CRMEB Java list sql injection
YüksekCVSS 7,2İstismar yokEPSS %0crmeb · crmeb3 Mar 2023
- CVE-2023-2522328İzleyin
CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.
YüksekCVSS 7,2İstismar yokEPSS %0crmeb · crmeb java7 Mar 2023
- CVE-2024-2411026İzleyin
SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the compon
OrtaCVSS 6,5İstismar yokEPSS %0crmeb · crmeb java20 Mar 2024
- CVE-2024-694422İzleyin
ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization
OrtaCVSS 5,3İstismar yokEPSS %3crmeb · crmeb21 Tem 2024
- CVE-2026-120222İzleyin
CRMEB LoginController.php appleLogin improper authentication
OrtaCVSS 5,5İstismar yokEPSS %0crmeb · crmeb19 Oca 2026
- CVE-2026-173422İzleyin
Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization
OrtaCVSS 5,5İstismar yokEPSS %0crmeb · crmeb1 Şub 2026
- CVE-2024-170321İzleyin
ZhongBangKeJi CRMEB openfile absolute path traversal
OrtaCVSS 5,3İstismar yokEPSS %0crmeb · crmeb21 Şub 2024
- CVE-2024-694321İzleyin
ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization
OrtaCVSS 5,3İstismar yokEPSS %0crmeb · crmeb21 Tem 2024