VendorsPerfex CRMperfex_crmall versions
Vulnerabilities

Perfex CRM Perfex CRM

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

13CVEs
CVE-2017-17976
In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.
Published 2018-01-26 · Modified
9.81 PoCEPSS 0.125
CVE-2025-10341
HTML injection in Perfex CRM
Published 2025-09-29 · Analyzed
6.1EPSS 0.002
CVE-2025-10342
HTML injection in Perfex CRM
Published 2025-09-29 · Analyzed
6.1EPSS 0.002
CVE-2025-10343
HTML injection in Perfex CRM
Published 2025-09-29 · Analyzed
6.1EPSS 0.002
CVE-2025-10344
HTML injection in Perfex CRM
Published 2025-09-29 · Analyzed
6.1EPSS 0.002
CVE-2025-10345
HTML injection in Perfex CRM
Published 2025-09-29 · Analyzed
6.1EPSS 0.002
CVE-2025-10346
HTML injection in Perfex CRM
Published 2025-09-29 · Analyzed
6.1EPSS 0.002
CVE-2020-28961
Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter.
Published 2021-10-22 · Modified
5.4EPSS 0.006
CVE-2021-40303
perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile.
Published 2022-11-08 · Modified
5.4EPSS 0.005
CVE-2024-8867
Perfex CRM Parameter Clients.php cross site scripting
Published 2024-09-15 · Analyzed
5.4EPSS 0.005
CVE-2024-44851
A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter.
Published 2024-09-11 · Analyzed
5.4EPSS 0.004
CVE-2025-3219
CodeCanyon Perfex CRM Project Discussions Module 2 cross site scripting
Published 2025-04-04 · Analyzed
5.4EPSS 0.004
CVE-2025-2974
CodeCanyon Perfex CRM Contracts contract cross site scripting
Published 2025-03-31 · Analyzed
5.4EPSS 0.004