CVE-2026-7783
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In CodeCanyon Perfex CRM up to 3.4.1, the AbstractKanban::applySortQuery function in application/services/AbstractKanban.php (Admin Kanban Endpoint component) is vulnerable to SQL injection via manipulation of the this argument. The attack can be initiated remotely, and the exploit has been published and may be used.
Risk Assessment
An attacker could execute arbitrary SQL queries, leading to leakage or modification of CRM data, including customer data. The public availability of the exploit increases the risk.
Recommendation
Implement parameterized queries in applySortQuery and restrict access to the Kanban endpoint; consider a WAF or upgrade to a patched version until a fix is available.
Other vulnerabilities in Perfex CRM
See all- CVE-2026-7782Medium
A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1 in the Clients::project function of application/controllers/Clients.php in the Tenant Handler component. Manipulating the ID argument results in authorization bypass. The attack may be performed remotely and the exploit is now public.
- CVE-2025-10346Medium
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knowledge_base/article'.
- CVE-2025-10345Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' and 'address' parameters to the 'admin/leads/lead' endpoint.
- CVE-2025-10344Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' and 'clientid' parameters to the '/projects/project/x' endpoint.
- CVE-2025-10343Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'expense_name' parameter to the '/expenses/expense' endpoint.
- CVE-2025-10342Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' parameter to the '/subscriptions/create' endpoint.
- CVE-2025-10341Medium
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint '/clients/client/x'.
Original NVD description (English source)
A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanban.php of the component Admin Kanban Endpoint. This manipulation of the argument this causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS