Vtiger Crm
74 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Vtiger Crm, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.
Vtiger Crm CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 1 |
| 2025-02 | 1 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 2 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 2 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 74 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical8
- High26
- Medium38
- Low2
Latest CVEs
The 15 most recently published vulnerabilities affecting Vtiger Crm.
- CVE-2026-23697Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module8.8
- CVE-2026-23698Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload7.2
- CVE-2025-45753A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature.7.2
- CVE-2025-45755A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing...6.1
- CVE-2025-1618vTiger CRM index.php cross site scripting4.3
- CVE-2024-54687Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.6.1
- CVE-2024-48119Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML.5.4
- CVE-2024-44777A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via inj...9.6
- CVE-2024-44776An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.6.1
- CVE-2024-44779A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser vi...9.6
- CVE-2024-44778A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via ...9.6
- CVE-2024-42995VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules.8.3
- CVE-2024-42994VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module.7.2
- CVE-2023-46304modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc...8.1
- CVE-2023-38891SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php.8.8
Product grouping is registry-driven, with AI assist and human review. How it works