Ahamed Yaseen

2 exploits Active since Oct 2025
CVE-2025-60374 WRITEUP MEDIUM WRITEUP
Perfex CRM < 3.3.1 - Stored Cross-Site Scripting in Chatbot
Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A different vulnerability than CVE-2024-8867.
CVSS 6.1
CVE-2025-60375 WRITEUP HIGH WRITEUP
Perfex CRM < 3.3.1 - Unauthenticated Authentication Bypass via Empty Credentials
The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and password parameters in the login request, an attacker can gain unauthorized access to user accounts, including administrative accounts, without providing valid credentials.
CVSS 7.3