https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-45753.htmlhttps://patchthecve.com/cve/CVE-2025-45753.htmlWed, 17 Jun 2026 09:25:39 +0000HIGH 7.2: A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature.https://patchthecve.com/cve/CVE-2025-45755.htmlhttps://patchthecve.com/cve/CVE-2025-45755.htmlWed, 17 Jun 2026 09:25:40 +0000MEDIUM 6.1: A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped to the Service Name field. When the file is uploaded, the application improperlhttps://patchthecve.com/cve/CVE-2025-1618.htmlhttps://patchthecve.com/cve/CVE-2025-1618.htmlWed, 17 Jun 2026 08:39:28 +0000MEDIUM 4.3: A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to cross site scripting. The attack can be initiated remotely. The exploit has beenhttps://patchthecve.com/cve/CVE-2024-54687.htmlhttps://patchthecve.com/cve/CVE-2024-54687.htmlWed, 17 Jun 2026 08:10:38 +0000MEDIUM 6.1: Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.https://patchthecve.com/cve/CVE-2024-48119.htmlhttps://patchthecve.com/cve/CVE-2024-48119.htmlWed, 17 Jun 2026 07:58:12 +0000MEDIUM 5.4: Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML.https://patchthecve.com/cve/CVE-2024-44779.htmlhttps://patchthecve.com/cve/CVE-2024-44779.htmlSun, 05 Jul 2026 01:20:28 +0000CRITICAL 9.6: A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.https://patchthecve.com/cve/CVE-2024-44778.htmlhttps://patchthecve.com/cve/CVE-2024-44778.htmlSun, 05 Jul 2026 01:20:28 +0000CRITICAL 9.6: A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.https://patchthecve.com/cve/CVE-2024-44777.htmlhttps://patchthecve.com/cve/CVE-2024-44777.htmlSun, 05 Jul 2026 01:20:27 +0000CRITICAL 9.6: A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.https://patchthecve.com/cve/CVE-2024-44776.htmlhttps://patchthecve.com/cve/CVE-2024-44776.htmlSun, 05 Jul 2026 01:20:26 +0000MEDIUM 6.1: An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.https://patchthecve.com/cve/CVE-2024-42995.htmlhttps://patchthecve.com/cve/CVE-2024-42995.htmlWed, 17 Jun 2026 07:50:15 +0000HIGH 8.3: VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules.https://patchthecve.com/cve/CVE-2024-42994.htmlhttps://patchthecve.com/cve/CVE-2024-42994.htmlWed, 17 Jun 2026 07:50:15 +0000HIGH 7.2: VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module.https://patchthecve.com/cve/CVE-2023-46304.htmlhttps://patchthecve.com/cve/CVE-2023-46304.htmlWed, 17 Jun 2026 06:30:37 +0000HIGH 8.1: modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file (executed on every page load).