CVE-2026-11456

HighCVSS 7.3

Published: 07/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A SQL injection vulnerability was found in Chanjet CRM 1.0 in the file /tools/jxf_dump_systable.php via the gblOrgID argument in the HTTP GET Request Handler component. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.

Risk Assessment

An unauthenticated attacker can remotely manipulate the CRM database, potentially leading to leakage or modification of sensitive customer data.

Recommendation

Immediately isolate the system from external networks and contact the vendor for a patch. In the meantime, apply WAF rules to block suspicious requests.

Other vulnerabilities in Chanjet CRM

CVE-2026-84111High
A vulnerability in Chanjet CRM up to version 20260707 affects the file jxf_dump_table.php. Manipulation of the gblOrgID argument causes SQL injection. The attack can be performed remotely, and the exploit has been published. The vendor did not respond to the disclosure.

Original NVD description (English source)

A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxf_dump_systable.php of the component HTTP GET Request Handler. Such manipulation of the argument gblOrgID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.