PatchTheCVEvtiger vulnerabilities
Recent CVEs affecting vtiger products. 11 tracked.
vtiger has 11 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-05-21. Highest priority: CVE-2024-44779 (score 48/100).
- CVE-2024-44779 CRITICAL 9.6 DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM
- CVE-2024-44778 CRITICAL 9.6 DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7
- CVE-2024-44777 CRITICAL 9.6 DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.
- CVE-2024-44776 MEDIUM 6.1 DOWNGRADE An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users t
- CVE-2025-45755 MEDIUM 6.1 DOWNGRADE A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable
- CVE-2025-45753 HIGH 7.2 DOWNGRADE A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute a
- CVE-2025-1618 MEDIUM 4.3 UPGRADE A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic
- CVE-2024-54687 MEDIUM 6.1 UPGRADE Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function
- CVE-2024-48119 MEDIUM 5.4 DOWNGRADE Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter
- CVE-2024-42995 HIGH 8.3 UPGRADE VTiger CRM <= 8.1.0 does not correctly check user privileges
- CVE-2024-42994 HIGH 7.2 UPGRADE VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL
FAQ
How do I fix vtiger vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vtiger being exploited right now?
None of the tracked vtiger CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vtiger CVE should I patch first?
CVE-2024-44779 currently ranks highest (48/100): A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM.