CVE-2026-15514
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A SQL injection vulnerability has been identified in Metasoft MetaCRM up to version 6.4.0 Beta06 within the PHPRPC Remote Call Interface component. The flaw exists in the file /customizemt/xkq/rpc.jsp, where the RPCService.query function improperly handles the phprpc_args argument. The attack can be executed remotely, and a public exploit is available.
Risk Assessment
The organization is at risk of remote database compromise via SQL injection, potentially leading to leakage, modification, or deletion of sensitive customer and corporate data.
Recommendation
Immediately upgrade MetaCRM to the latest available version or apply temporary input sanitization in rpc.jsp. If vendor support is unavailable, consider migrating to an alternative CRM solution.
Other vulnerabilities in MetaCRM
See all- CVE-2026-16324High
Vulnerability in Metasoft 美特软件 MetaCRM up to version 6.4.0 Beta06. An unknown function in the file /business/qnaire/upload.jsp allows unrestricted file upload via the File argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10205Medium
A vulnerability was found in MetaCRM 6.4.0 by Metasoft 美特软件 in the file develop/systparam/softlogo/upload.jsp. An unknown function allows unrestricted file upload. The attack can be performed remotely and the exploit has been published.
Original NVD description (English source)
A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/xkq/rpc.jsp of the component PHPRPC Remote Call Interface. Executing a manipulation of the argument phprpc_args can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.