Known vulnerabilities in Vtiger CRM

Vendor: Vtiger
Software: Vtiger CRM
Software CPE: cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*
Website: https://www.vtiger.com/
Total vulnerabilities: 18
Public exploits: 8
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Vtiger CRM Vtiger CRM is affected by 18 known vulnerabilities: 3 high, 9 medium, 6 low Critical High Medium Low

Vulnerabilities (18)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU94630 - Improper Access Control
CVE-2024-42995		 CWE-284 Medium
Available
No
 8.2.0 22.07.2024 SB2024072201
#VU94629 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-42994		 CWE-89 Medium
Available
No
 8.2.0 22.07.2024 SB2024072201
#VU67707 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-38335		 CWE-79 Low
No
No
 - 27.09.2022 SB2022092749
#VU34834 - Unrestricted Upload of File with Dangerous Type
CVE-2013-3591		 CWE-434 High
Available
No
 - 07.02.2020 SB2020020724
#VU35873 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2016-10754		 CWE-89 High
No
No
 - 24.05.2019 SB2019052415
#VU35892 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-11057		 CWE-89 High
No
No
 - 17.05.2019 SB2019010409
#VU36249 - Unrestricted Upload of File with Dangerous Type
CVE-2019-5009		 CWE-434 Medium
No
No
 - 04.01.2019 SB2019010409
#VU39178 - Unrestricted Upload of File with Dangerous Type
CVE-2016-1713		 CWE-434 Low
Available
No
 - 14.04.2017 SB2017041408
#VU256 - Permissions, Privileges, and Access Controls
CVE-2016-4834		 CWE-264 Medium
No
No
 - 02.08.2016 SB2016080110
#VU41103 - Permissions, Privileges, and Access Controls
CVE-2014-2268		 CWE-264 Medium
Available
No
 - 16.11.2014 SB2014111603
#VU41779 - Improper input validation
CVE-2014-2269		 CWE-20 Medium
No
No
 - 22.04.2014 SB2014042206
#VU41852 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2013-3213		 CWE-89 Medium
No
No
 - 02.04.2014 SB2014021405
#VU42034 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2013-7326		 CWE-79 Low
No
No
 - 14.02.2014 SB2014021405
#VU42483 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2013-5091		 CWE-89 Low
Available
No
 - 04.10.2013 SB2013100403
#VU43623 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2012-4867		 CWE-22 Medium
Available
No
 - 06.09.2012 SB2012090605
#VU44470 - Permissions, Privileges, and Access Controls
CVE-2011-4679		 CWE-264 Low
No
No
 5.3.0 07.12.2011 SB2011120701
#VU44471 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2011-4680		 CWE-79 Low
No
No
 - 07.12.2011 SB2011120702
#VU44486 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2011-4559		 CWE-89 Medium
Available
No
 - 28.11.2011 SB2011112803