Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-116008

DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bottelet Daybydaycrm
Products
Daybydaycrm Daybyday Crm
CVE-2026-10283

Bottelet DaybydayCRM Setting missing authentication

A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1. Affected is an unknown function of the component Setting Handler. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bottelet
Products
Daybydaycrm
CVE-2026-10282

Bottelet DaybydayCRM DocumentsController.php view improper authorization

A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsController.php. Such manipulation leads to improper authorization. The attack may be launched remotely. It is best practice to apply a patch to resolve this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bottelet
Products
Daybydaycrm