Rukovoditel vulnerabilities
We track 5 vulnerabilities in Rukovoditel products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 11, 2026.
Latest Rukovoditel vulnerabilities
- 9.3 Critical severity
Rukovoditel CRM: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into t
- 8.8 High severity
Rukovoditel: Improper Neutralization of Formula Elements in a CSV File
Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV
- 9.8 Critical severity
Rukovoditel: Improper Control of Generation of Code
Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.
- 8.8 High severity
Rukovoditel: Improper Neutralization of Input During Web Page Generation
Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
- 8.8 High severity
Rukovoditel: Improper Neutralization of Special Elements used in an SQL Command
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.