Vulnerabilidades de Rukovoditel
CVEs publicadas que afetam produtos de Rukovoditel: 4 registro(s), com severidade, exploração e correções.
CVE-2026-31845
Crítica · 9.3
CWE-79 11/04/2026
XSS Refletido no Endpoint da API Zadarma do Rukovoditel CRM
Uma vulnerabilidade de cross-site scripting (XSS) refletido existe no Rukovoditel CRM versão 3.6.4 e anteriores, no endpoint da API de telefonia Zadarma (/api/tel/zadarma.php). A aplicação reflete diretamente a entrada fornecida pelo usuário, proveniente do parâmetro GET 'zd_echo', na resposta HTTP sem sanitização adequada, codificação de saída ou restrições de tipo de conteúdo.
CVE-2023-53913
Alta · 8.8
CWE-1236 17/12/2025
Rukovoditel 3.3.1 CSV Injection via User Account Export
Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV file.
CVE-2023-53898
Média · 5.4
CWE-79 16/12/2025
Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Configuration
Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert iframe and script payloads in application copyright text to execute arbitrary JavaScript in victim browsers.
CVE-2023-53897
Média · 5.4
CWE-79 16/12/2025
Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments
Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert XSS payloads in project task comments to execute arbitrary JavaScript in victim browsers.