Perfexcrm
Perfexcrm Perfex CRM: vulnerabilidades y CVE
Perfexcrm Perfex CRM tiene 15 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE15
Últimos 12 meses1
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-60374 | Media (6.1) | 0.34% | — | 14 oct 2025 | Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code… |
| CVE-2025-10346 | Media (5.3) | 0.19% | — | 29 sept 2025 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint… |
| CVE-2025-10345 | Media (5.3) | 0.24% | — | 29 sept 2025 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'address' at the endpoint… |
| CVE-2025-10344 | Media (5.3) | 0.24% | — | 29 sept 2025 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'clientid' at the endpoint… |
| CVE-2025-10343 | Media (5.3) | 0.24% | — | 29 sept 2025 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'expense_name' at the endpoint… |
| CVE-2025-10342 | Media (5.3) | 0.24% | — | 29 sept 2025 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'name' at the endpoint… |
| CVE-2025-10341 | Media (5.3) | 0.24% | — | 29 sept 2025 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint… |
| CVE-2025-3219 | Media (5.1) | 0.38% | — | 4 abr 2025 | A vulnerability was found in CodeCanyon Perfex CRM 3.2.1. It has been classified as problematic. Affected is an unknown function of the file /perfex/clients/project/2 of the component Project Discussions Module. The… |
| CVE-2025-2974 | Media (5.1) | 0.37% | — | 31 mar 2025 | A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the… |
| CVE-2024-56908 | Media (6.8) | 0.63% | — | 13 feb 2025 | In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input in the rel_id parameter, combined with improper input… |
| CVE-2024-8867 | Media (5.3) | 0.48% | — | 15 sept 2024 | A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers/Clients.php of the component Parameter Handler. The… |
| CVE-2024-44851 | Media (5.4) | 0.40% | — | 11 sept 2024 | A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter. |
| CVE-2021-40303 | Media (5.4) | 0.53% | — | 8 nov 2022 | perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile. |
| CVE-2020-28961 | Media (5.4) | 0.58% | — | 22 oct 2021 | Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter. |
| CVE-2017-17976 | Crítica (9.8) | 13% | — | 26 ene 2018 | In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution. |