Daybyday Crm
Approved changes feed: RSS · Atom
cpe:2.3:a:daybydaycrm:daybyday_crm:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Daybydaycrm (96d59825-6420-5007-9a9d-9ca54c2ee80e) |
|---|---|
| Product | Daybyday Crm (8428780b-4351-58ea-ae83-ad278ac9b588) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/bottelet/daybydaycrm |
purl2cpe | 2026-06-01 10:12:41.253878 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-116008 |
vulnerable | 2026-11-03 10:15:21.997328 |
DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
MEDIUM (4.3)
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.
Published: 2026-10-24T11:40:28.129Z
Updated: 2026-11-05T17:25:48.593Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-22110 |
vulnerable | 2026-06-08 05:40:05.910216 |
DayByDay CRM - Weak Password Requirements in Update User
HIGH (7.5)
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
Published: 2022-01-05T15:05:21.000Z
Updated: 2024-08-03T03:00:55.381Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-22108 |
vulnerable | 2026-06-08 05:40:05.907624 |
DayByDay CRM - Missing Authorization when Viewing Absences
MEDIUM (4.3)
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
Published: 2022-01-05T15:05:18.000Z
Updated: 2024-08-03T03:00:55.285Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-22107 |
vulnerable | 2026-06-08 05:40:05.906975 |
DayByDay CRM - Missing Authorization when Viewing Appointments
MEDIUM (4.3)
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
Published: 2022-01-05T15:05:16.000Z
Updated: 2024-08-03T03:00:55.213Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.