DefaultFuction vulnerabilities
Published CVEs affecting DefaultFuction products: 4 record(s), with severity, exploitation and fixes.
Content Management System 1Jeson Customer Relationship Management System 1Notice-System-Managent 1Customer-Relationship-Management-In-C-Project 1
CVE-2026-19933
Medium · 6.3
CWE-119 Aug 16, 2026
DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow
A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project confirms, that "it’s being processed".
CVE-2026-19932
Medium · 6.3
CWE-74 Aug 16, 2026
DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".
CVE-2026-5333
Critical · 9.8
CWE-77 Apr 2, 2026
DefaultFuction Content-Management-System tools.php command injection
A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-3616
Medium · 6.3
CWE-74 Mar 6, 2026
DefaultFuction Jeson Customer Relationship Management System edit.php sql injection
A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue.