Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-111349

Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Puemos
Products
Craftplan
CVE-2026-76876

Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Puemos
Products
Craftplan