Fatfreecrm develops a lightweight, open-source customer relationship management platform whose vulnerability profile centers on classic web application input-handling flaws: cross-site scripting, SQL injection, improper input validation, cross-site request forgery, and exposure of sensitive information. The product's modest footprint belies its appearance in a prominent slice of the vulnerability landscape, and its disclosures demonstrate a recurring tendency toward public exploit availability alongside these application-layer weaknesses. Defenders deploying this platform should prioritize web input sanitization, parameterized queries, and CSRF protections as foundational controls; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Fatfreecrm over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-10226MEDIUM HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance | Jun 10, 2019 | 5.4 | 30 | NO | YES |
CVE-2022-39281MEDIUM fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Se | Oct 8, 2022 | 6.5 | 23 | NO | NO |
CVE-2013-7225MEDIUM Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1 | Jan 2, 2014 | 6.5 | 22 | NO | NO |
CVE-2013-7223MEDIUM Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vect | Jan 2, 2014 | 6.8 | 22 | NO | NO |
CVE-2018-1000842MEDIUM FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d664 | Dec 20, 2018 | 6.1 | 21 | NO | NO |
CVE-2018-20975MEDIUM Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb. | Aug 20, 2019 | 6.1 | 19 | NO | NO |
CVE-2013-7249MEDIUM Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for | Jan 2, 2014 | 5.0 | 19 | NO | NO |
CVE-2013-7224MEDIUM Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request fo | Jan 2, 2014 | 5.0 | 19 | NO | NO |
CVE-2015-1585MEDIUM Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted H | Feb 19, 2015 | 6.8 | 18 | NO | NO |
CVE-2014-5441MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script o | Sep 12, 2014 | 4.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Fatfreecrm.
Media articles that mention a CVE ID that affects a product developed by Fatfreecrm — matched by CVE ID, not by vendor name.