CVE-2023-50035

9.8 criticalEPSS 0.6%

Critical (9.8) in small crm project small crm. EPSS 0.6% chance of exploitation in the next 30 days.

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2023-12-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

small_crm_project:small_crm

References

https://github.com/hackerhijeck/Exploited/blob/main/Small_CRM/SQL-Injection.md
https://github.com/hackerhijeck/Exploited/blob/main/Small_CRM/SQL-Injection.md

Check your stack JSON