MetaCRM vulnerabilities
3 known CVE vulnerabilities in MetaCRM, translated and rated.
- CVE-2026-16324High
Vulnerability in Metasoft 美特软件 MetaCRM up to version 6.4.0 Beta06. An unknown function in the file /business/qnaire/upload.jsp allows unrestricted file upload via the File argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-15514High
A SQL injection vulnerability has been identified in Metasoft MetaCRM up to version 6.4.0 Beta06 within the PHPRPC Remote Call Interface component. The flaw exists in the file /customizemt/xkq/rpc.jsp, where the RPCService.query function improperly handles the phprpc_args argument. The attack can be executed remotely, and a public exploit is available.
- CVE-2026-10205Medium
A vulnerability was found in MetaCRM 6.4.0 by Metasoft 美特软件 in the file develop/systparam/softlogo/upload.jsp. An unknown function allows unrestricted file upload. The attack can be performed remotely and the exploit has been published.