Rukovoditel vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-31845 A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarmaCritical 9.3 · Apr 11, 2026
• CVE-2024-34469 Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.High 7.1 · May 4, 2024
• CVE-2022-48175 Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.Critical 9.8 · Jan 30, 2023
• CVE-2022-45020 Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login.High 8.8 · Dec 5, 2022
• CVE-2022-44945 Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.Critical 9.8 · Dec 2, 2022
• CVE-2022-43288 Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.High 8.8 · Nov 14, 2022
• CVE-2022-43168 Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.Critical 9.8 · Oct 28, 2022
• CVE-2020-13590 Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2.High 7.2 · Apr 18, 2022
• CVE-2020-13589 An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2.High 8.8 · Aug 17, 2021
• CVE-2020-13588 An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2.High 8.8 · Aug 17, 2021
• CVE-2021-30224 Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials.High 8.8 · Apr 29, 2021
• CVE-2020-13592 An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2.High 8.8 · Apr 9, 2021
• CVE-2020-13591 An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2.High 8.8 · Apr 9, 2021
• CVE-2020-13587 An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2.High 8.8 · Apr 9, 2021
• CVE-2020-11817 In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the content-type value.Critical 9.8 · Apr 27, 2020
• CVE-2020-11820 Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities_id parameter.Critical 9.8 · Apr 16, 2020
• CVE-2020-11819 In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.Critical 9.8 · Apr 16, 2020
• CVE-2020-11818 In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks.High 8.8 · Apr 16, 2020
• CVE-2020-11816 Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports_id (POST) parameter.Critical 9.8 · Apr 16, 2020
• CVE-2020-11815 In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value.Critical 9.8 · Apr 16, 2020
• CVE-2020-11812 Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters[0][value] or filters[1][value] parameter.Critical 9.8 · Apr 16, 2020
• CVE-2018-20166 A file-upload vulnerability exists in Rukovoditel 2.3.1.High 8.8 · Jan 2, 2019