彙總 Vtiger 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 路徑處理缺陷與輸入驗證問題 等問題，部分漏洞可能導致 檔案覆寫，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-45753 | A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature. | [email protected] | 7.2 | 0.40% | 2025-05-21 | 2025-06-10 |
| CVE-2025-45755 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped to the Service Name field. When the file is uploaded, the application improperly sanitizes user input, leading to persistent script execution. | [email protected] | 6.1 | 0.23% | 2025-05-21 | 2025-06-10 |
| CVE-2025-1618 | A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component. | [email protected] | 5.3 | 0.19% | 2025-02-24 | 2026-01-29 |
| CVE-2024-54687 | Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php. | [email protected] | 6.1 | 0.18% | 2025-01-10 | 2025-04-17 |
| CVE-2024-48119 | Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML. | [email protected] | 5.4 | 0.21% | 2024-10-14 | 2024-10-30 |
| CVE-2024-44779 | A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. | [email protected] | 9.6 | 2.16% | 2024-08-29 | 2024-09-03 |
| CVE-2024-44778 | A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. | [email protected] | 9.6 | 0.75% | 2024-08-29 | 2024-09-03 |
| CVE-2024-44777 | A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. | [email protected] | 9.6 | 0.57% | 2024-08-29 | 2024-09-03 |
| CVE-2024-44776 | An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL. | [email protected] | 6.1 | 0.39% | 2024-08-29 | 2025-03-25 |
| CVE-2024-42995 | VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules. | [email protected] | 8.3 | 0.10% | 2024-08-16 | 2025-04-28 |
| CVE-2024-42994 | VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module. | [email protected] | 7.2 | 0.09% | 2024-08-16 | 2025-04-28 |
| CVE-2023-46304 | modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load). | [email protected] | 8.1 | 20.76% | 2024-04-30 | 2025-04-22 |
| CVE-2023-38891 | SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php. | [email protected] | 8.8 | 3.39% | 2023-09-14 | 2024-11-21 |
| CVE-2022-38335 | Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules. | [email protected] | 5.4 | 0.51% | 2022-09-27 | 2025-05-21 |
| CVE-2020-22807 | An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature. | [email protected] | 9.8 | 0.26% | 2021-04-29 | 2024-11-21 |
| CVE-2020-19363 | Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories. | [email protected] | 6.5 | 6.15% | 2021-01-20 | 2024-11-21 |
| CVE-2020-19362 | Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page. | [email protected] | 6.1 | 0.24% | 2021-01-20 | 2024-11-21 |
| CVE-2013-3591 | vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability | [email protected] | 8.8 | 79.37% | 2020-02-07 | 2024-11-21 |
| CVE-2015-6000 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/. | [email protected] | 8.8 | 76.81% | 2020-02-06 | 2024-11-21 |
| CVE-2013-3215 | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. | [email protected] | 9.8 | 73.67% | 2020-01-29 | 2024-11-21 |