CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3616
https://notcve.org/view.php?id=CVE-2007-3616
index.php in vtiger CRM before 5.0.3 allows remote authenticated users to perform administrative changes to arbitrary profile settings via a certain profilePrivileges action in the Users module. index.php de vtiger CRM versiones anteriores a 5.0.3 permite a usuarios remotos autenticados realizar cambios administrativos a propiedades de perfil de su elección mediante una acción profilePrivileges determinada en el módulo Users. • http://trac.vtiger.com/cgi-bin/trac.cgi/report/9 http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/2237 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4617
https://notcve.org/view.php?id=CVE-2006-4617
Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder. Vulnerabilidad de actualización de archivo no restrictiva en fileupload.html en vtiger CRM 4.2.4, y posiblemente versiones anteriores, permite a un atacante remoto actualizar y ejecutar ficheros de su elección con extensiones ejecutables en la carpeta /cashe/mails. • http://www.osvdb.org/28459 http://www.security-net.biz/adv/D3906a.txt •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2005-3822
https://notcve.org/view.php?id=CVE-2005-3822
Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username in the login form or (2) record parameter, as demonstrated in the EditView action for the Contacts module. • http://marc.info/?l=full-disclosure&m=113290708121951&w=2 http://secunia.com/advisories/17693 http://securityreason.com/securityalert/203 http://securitytracker.com/id?1015274 http://www.securityfocus.com/archive/1/417711/30/0/threaded http://www.securityfocus.com/bid/15569 http://www.vupen.com/english/advisories/2005/2569 •
CVSS: 5.0EPSS: 3%CPEs: 1EXPL: 0CVE-2005-3824
https://notcve.org/view.php?id=CVE-2005-3824
The uploads module in vTiger CRM 4.2 and earlier allows remote attackers to upload arbitrary files, such as PHP files, via the add2db action. • http://marc.info/?l=full-disclosure&m=113290708121951&w=2 http://secunia.com/advisories/17693 http://securitytracker.com/id?1015274 http://www.securityfocus.com/archive/1/417711/30/0/threaded http://www.securityfocus.com/bid/15569 http://www.vupen.com/english/advisories/2005/2569 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2005-3823
https://notcve.org/view.php?id=CVE-2005-3823
The Users module in vTiger CRM 4.2 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval function. • http://marc.info/?l=full-disclosure&m=113290708121951&w=2 http://secunia.com/advisories/17693 http://securitytracker.com/id?1015274 http://www.securityfocus.com/archive/1/417711/30/0/threaded http://www.securityfocus.com/bid/15569 http://www.vupen.com/english/advisories/2005/2569 •