CVE-2025-70936

In Vtiger CRM 6.4.0, there is an unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class that allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension.

A reflected cross-site scripting (XSS) vulnerability was found in the viewname parameter on the index page of vTiger CRM 7.4.0. It allows an attacker to execute arbitrary JavaScript code in the victim's browser by injecting a crafted payload.

A reflected cross-site scripting (XSS) vulnerability exists in the 'parent' parameter of the index page in vTiger CRM 7.4.0. Attackers can execute arbitrary JavaScript code in the victim's browser by injecting a crafted payload.

A reflected XSS vulnerability was found in vTiger CRM 7.4.0 in the 'tag' parameter on the index page. An attacker can inject malicious JavaScript that executes in the victim's browser.

Vtiger CRM up to version 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature. An administrator can upload a crafted ZIP archive that extracts arbitrary PHP files into the modules/ directory under the web root without validating file types beyond manifest.xml.

Vtiger CRM before version 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file with arbitrary PHP code via the Documents module. The vulnerability is due to the omission of the .phar extension from the denylist in config.inc.php and a misconfigured .htaccess file that is silently ignored on Apache 2.4 deployments.

An Open Redirect vulnerability was found in vTiger CRM v7.4.0 in the 'page' parameter. An attacker can craft a URL to redirect users to a malicious site.