CVE-2026-50769
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The CRM+ application from Brainformatik, versions up to and including 2025.6, is vulnerable to time-based SQL Injection. The check conflict endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true) used to check user calendar conflicts is vulnerable to SQL injection, allowing an attacker to execute arbitrary code.
Risk Assessment
An attacker can exploit the vulnerability to execute arbitrary SQL queries, potentially leading to data theft, database modification, or full system takeover.
Recommendation
Update CRM+ to a version newer than 2025.6 if a patch is available. Additionally, use parameterized SQL queries and input validation on endpoints.
Original NVD description (English source)
The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is vulnerable to SQL injection allowing an attacker to execute arbitrary code.