trainingbusinesspros vulnerabilities

Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation

Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter

trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation