Fatfreecrm

    Dashboard / Vendors

    Products: 2
    Vulnerabilities: 12
    Known Exploited: 0
    0
    Critical Level Threats
    0
    High Level Threats
    12
    Medium Level Threats
    0
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2026-113600

    Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy

    Last Modified: Oct 23, 2026
    Published: Oct 20, 2026

    CVE-2022-39281

    Remote Denial of Service via Tasks endpoint in fat_free_crm

    Last Modified: Apr 23, 2025
    Published: Oct 08, 2022

    CVE-2018-20975

    Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.

    Last Modified: Nov 21, 2024
    Published: Aug 20, 2019

    CVE-2019-10226

    HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.

    Last Modified: Nov 21, 2024
    Published: Jun 10, 2019

    CVE-2018-1000842

    FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.

    Last Modified: Nov 21, 2024
    Published: Dec 20, 2018
    Items Per Page
    Fatfreecrm Vulnerabilities & Security CVEs | CVE-DB