CVE-2005-3823

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-11-26 · updated 2026-06-16

Description

The Users module in vTiger CRM 4.2 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval function.

Affected products

Vtiger CRM: through 4.2

References

http://marc.info/?l=full-disclosure&m=113290708121951&w=2
http://secunia.com/advisories/17693
http://securitytracker.com/id?1015274
http://www.securityfocus.com/archive/1/417711/30/0/threaded
http://www.securityfocus.com/bid/15569
http://www.vupen.com/english/advisories/2005/2569
http://marc.info/?l=full-disclosure&m=113290708121951&w=2
http://secunia.com/advisories/17693
http://securitytracker.com/id?1015274
http://www.securityfocus.com/archive/1/417711/30/0/threaded
http://www.securityfocus.com/bid/15569
http://www.vupen.com/english/advisories/2005/2569

Get alerted when CVE-2005-3823 or the next vulnerability affects your stack