vtiger crm vulnerabilities and fixes

Q: How do I fix vtiger crm vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is vtiger crm being exploited right now?

None of the tracked vtiger crm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which vtiger crm CVE should I patch first?

CVE-2024-44779 currently ranks highest (48/100): A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM.

Recent CVEs affecting vtiger crm, with upgrade or downgrade steps. 11 tracked.

Also searched as: vtigercrm.

vtiger crm has 11 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-05-21. Highest priority: CVE-2024-44779 (score 48/100).

CVE-2024-44779 CRITICAL 9.6 DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM
CVE-2024-44778 CRITICAL 9.6 DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7
CVE-2024-44777 CRITICAL 9.6 DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.
CVE-2024-44776 MEDIUM 6.1 DOWNGRADE An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users t
CVE-2025-45755 MEDIUM 6.1 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable
CVE-2025-45753 HIGH 7.2 DOWNGRADE A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute a
CVE-2025-1618 MEDIUM 4.3 UPGRADE A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic
CVE-2024-54687 MEDIUM 6.1 UPGRADE Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function
CVE-2024-48119 MEDIUM 5.4 DOWNGRADE Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter
CVE-2024-42995 HIGH 8.3 UPGRADE VTiger CRM <= 8.1.0 does not correctly check user privileges
CVE-2024-42994 HIGH 7.2 UPGRADE VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL

FAQ

How do I fix vtiger crm vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is vtiger crm being exploited right now?

None of the tracked vtiger crm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which vtiger crm CVE should I patch first?

CVE-2024-44779 currently ranks highest (48/100): A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM.

RSS feed for vtiger crm · ← Back to latest CVEs