Crmeb vulnerabilities
We track 16 vulnerabilities in Crmeb products across 2 products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest Crmeb vulnerabilities
- 7.1 High severity
CRMEB: Authorization Bypass Through User-Controlled Key
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest
- 8.3 High severity
CRMEB: Missing Authorization
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the i
- 7.3 High severity
crmeb_java: Server-Side Request Forgery
A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument u
- 8.1 High severity
CRMEB: Improper Authentication
A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php of the component JSON Token Handler. Executing a manipulation of the argument uid can lead to imprope
- 9.8 Critical severity
CRMEB: Improper Authentication
A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The atta
- 7.2 High severity
CRMEB: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation of the argument cate_id leads to sql injection. The attack may be launched remotely. The exploit is
- 7.2 High severity
CRMEB: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of the argument cate_id causes sql injection. The attack may be initiated remotely. The exploit has been p
- 8.1 High severity
A vulnerability was identified in CRMEB up to 5.6.1.
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to lau
- 8.8 High severity
CRMEB: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET Parameter Handler. Performing a manipulation of the argument cate_id results in sql injection. Remote
- 8.8 High severity
CRMEB: Server-Side Request Forgery
A security vulnerability has been detected in CRMEB up to 5.6.1. The impacted element is the function testOutUrl of the file app/services/out/OutAccountServices.php. The manipulation of the argument push_token_url leads to server-side request forgery. Remote e
- 8.8 High severity
CRMEB: Incorrect Privilege Assignment
A weakness has been identified in CRMEB up to 5.6.1. The affected element is the function editAddress of the file app/services/user/UserAddressServices.php. Executing manipulation of the argument ID can lead to improper authorization. The attack may be launche
- 8.8 High severity
CRMEB: Incorrect Privilege Assignment
A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the component Administrator Password Handler. Performing manipulation of the argument ID results in imprope
- 7.5 High severity
crmeb: Improper Access Control
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon colle
- 7.5 High severity
crmeb: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.
- 7.5 High severity
crmeb_java: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude parameters in the api/front/store/list component.
- 7.2 High severity
CRMEB Java: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been di