CVE-2026-86170

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86170
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86170.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86170
Published
2026-09-06T05:45:11Z
Modified
2026-09-11T03:30:25Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
DefaultFuction CRM edit.php sql injection
Details

A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-74",
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86170.json"
}
References

Affected packages

Git / github.com/defaultfuction/customer-relationship-management-system

Affected ranges

Type
GIT
Repo
https://github.com/defaultfuction/customer-relationship-management-system
Events
Introduced
e8acada2ff7161897b8e124a20369efcaf82072d
Last Affected
e8acada2ff7161897b8e124a20369efcaf82072d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0
V1.*
V1.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86170.json"