CVE-2026-10283

MediumCVSS 6.3

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

Vulnerability in Bottelet DaybydayCRM up to 2.2.1. An unknown function in the Setting Handler component allows missing authentication. Remote exploitation is possible.

Risk Assessment

An attacker can gain unauthorized access to CRM settings, potentially leading to configuration modification or data leakage.

Recommendation

Apply the patch provided by the vendor.

Other vulnerabilities in Bottelet DaybydayCRM

CVE-2026-10282Medium
In Bottelet DaybydayCRM up to 2.2.1, an improper authorization vulnerability was found in the view function in app/Http/Controllers/DocumentsController.php. The attack can be performed remotely. A patch is recommended.

Original NVD description (English source)

A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1. Affected is an unknown function of the component Setting Handler. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. It is recommended to apply a patch to fix this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS