GCVE - cpe:2.3:a:crmeb:crmeb_java:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:crmeb:crmeb_java:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Crmeb (`74776fee-3733-5224-811a-51c1e3d4a7e4`)
Product	Crmeb Java (`28ec8674-3841-5896-aade-43ffa6f6e7f5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/crmeb/crmeb_java`	purl2cpe	2026-06-01 10:16:13.401297

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-10771`	vulnerable	2026-06-08 07:47:13.882423	crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery HIGH (7.3) A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. Published: 2026-06-03T21:30:09.322Z Updated: 2026-06-04T13:14:56.040Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/368137 https://vuldb.com/vuln/368137/cti https://vuldb.com/cve/CVE-2026-10771 https://vuldb.com/submit/831421 https://github.com/crmeb/crmeb_java/issues/35	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-28714`	vulnerable	2026-06-08 06:33:27.133110	Details available SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter. Published: 2024-03-28T00:00:00.000Z Updated: 2026-07-09T00:30:37.943Z Open on db.gcve.eu Reference links https://gitee.com/ZhongBangKeJi/crmeb_java https://github.com/JiangXiaoBaiJia/cve2/blob/main/a.png https://github.com/JiangXiaoBaiJia/cve2/blob/main/1.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-24110`	vulnerable	2026-06-08 06:29:41.113263	Details available SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spread/people. Published: 2024-02-29T00:00:00.000Z Updated: 2024-08-05T13:12:53.287Z Open on db.gcve.eu Reference links https://github.com/crmeb/crmeb_java/issues/13	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-25223`	vulnerable	2026-06-08 05:56:08.684845	Details available CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list. Published: 2023-03-07T00:00:00.000Z Updated: 2025-03-05T15:38:06.874Z Open on db.gcve.eu Reference links https://github.com/crmeb/crmeb_java/issues/9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-1609`	vulnerable	2026-06-08 05:52:36.184502	Zhong Bang CRMEB Java save cross site scripting LOW (3.5) A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/store/product/save. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223739. Published: 2023-03-23T20:00:05.271Z Updated: 2024-08-02T05:57:24.983Z Open on db.gcve.eu Reference links https://vuldb.com/?id.223739 https://vuldb.com/?ctiid.223739 https://github.com/crmeb/crmeb_java/issues/12	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-1608`	vulnerable	2026-06-08 05:52:36.183941	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.