CVE-2026-86172
MediumCVSS 6.3Summary
A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Risk Assessment
SQL injection could allow an attacker to read, modify, or delete data in the database, potentially leading to confidentiality, integrity, and availability breaches.
Recommendation
Apply vendor fixes or use parameterized queries to prevent SQL injection. Restrict access to the delete.php file.
Other vulnerabilities in DefaultFuction CRM
See all- CVE-2026-86171Medium
A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
- CVE-2026-86170Medium
A vulnerability has been identified in DefaultFuction CRM 1.0.0, specifically in the file /modules/orders/edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.