Zhong Bang vulnerabilities
We track 6 vulnerabilities in Zhong Bang products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on June 14, 2023.
Latest Zhong Bang vulnerabilities
- 9.8 Critical severity
CRMEB: Deserialization of Untrusted Data
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been declared as problematic. Affected by this vulnerability is the function put_image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack c
- 8.8 High severity
CRMEB: Server-Side Request Forgery
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/controller/v1/PublicController.php. The manipulation leads to server-side request forgery. It is possible t
- 9.8 Critical severity
CRMEB: Deserialization of Untrusted Data
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file /api/wechat/app_auth of the component Image Upload. The manipulation leads to deserialization. The exploit has been dis
- 7.2 High severity
CRMEB: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file \crmeb\app\services\system\attachment\SystemAttachmentServices.php. The manipulation of the argument filename
- 9.8 Critical severity
CRMEB Java: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. Th
- 7.2 High severity
CRMEB Java: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been di