Skip to content
OpenAdvisories

Vendor

crmeb

5 known vulnerabilities.

Products

CRMEB 3 crmeb_java 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-111359

    CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift

    CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harves…

    crmeb CRMEB
  • High 8.3
    CVE-2026-85212

    CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check

    CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the …

    crmeb CRMEB
  • High 7.3
    CVE-2026-10771

    crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery

    A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument …

    crmeb crmeb_java