CVE-2026-16324
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Vulnerability in Metasoft 美特软件 MetaCRM up to version 6.4.0 Beta06. An unknown function in the file /business/qnaire/upload.jsp allows unrestricted file upload via the File argument. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can upload malicious files to the server, potentially leading to full compromise of the CRM system and access to customer data.
Recommendation
Contact the vendor for a patch or consider replacing the system if the vendor does not respond.
Other vulnerabilities in MetaCRM
See all- CVE-2026-15514High
A SQL injection vulnerability has been identified in Metasoft MetaCRM up to version 6.4.0 Beta06 within the PHPRPC Remote Call Interface component. The flaw exists in the file /customizemt/xkq/rpc.jsp, where the RPCService.query function improperly handles the phprpc_args argument. The attack can be executed remotely, and a public exploit is available.
- CVE-2026-10205Medium
A vulnerability was found in MetaCRM 6.4.0 by Metasoft 美特软件 in the file develop/systparam/softlogo/upload.jsp. An unknown function allows unrestricted file upload. The attack can be performed remotely and the exploit has been published.
Original NVD description (English source)
A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.