fatfreecrm/fat_free_crm Security Advisories | GitStock

low2026-04-14

Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

GHSA-9pm8-vwc5-w2hm

medium2022-10-07

Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint

GHSA-p75c-5x3h-cxcg · CVE-2022-39281

medium2022-05-17

Fat Free CRM contains Cross-site Request Forgery vulnerablilities

GHSA-mcvq-7xjq-46x6 · CVE-2013-7223

medium2022-05-17

Fat Free CRM has fixed token value

GHSA-g897-cgfc-7q8v · CVE-2013-7222

medium2022-05-17

Fat Free CRM vulnerable to Exposure of Sensitive Information

GHSA-f25h-3mj6-4jpg · CVE-2013-7249

medium2022-05-17

Fat Free CRM vulnerable to SQL Injection

GHSA-9ggp-5rf4-x7q9 · CVE-2013-7225

medium2022-05-17

Fat Free CRM allows remote attackers to obtain sensitive information via a direct request

GHSA-4xq9-vw89-p5cx · CVE-2013-7224

medium2022-05-17

Fat Free CRM subject to Cross-site Scripting

GHSA-wcfx-3m6v-4frg · CVE-2014-5441

medium2022-05-14

Fat Free CRM Cross-Site Request Forgery vulnerability

GHSA-wx7c-8j35-mpg8 · CVE-2015-1585