CVE-2026-7783mediumCWE-74CWE-89

CVE-2026-7783: medium-severity vulnerability in CodeCanyon Perfex CRM

CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection

Published · Updated

Follow this CVE+ Monitor Perfex CRM

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanban.php of the component Admin Kanban Endpoint. This manipulation of the argument this causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
CodeCanyon · Perfex CRM
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — CodeCanyon Perfex CRM

In the same product, most dangerous first.

CVE-2025-3219MEDIUMCodeCanyon Perfex CRM Project Discussions Module 2 cross site scriptingEPSS 0.4%CVE-2025-2974MEDIUMCodeCanyon Perfex CRM Contracts contract cross site scriptingEPSS 0.4%CVE-2026-7782MEDIUMCodeCanyon Perfex CRM Tenant Clients.php project authorizationEPSS 0.2%