CVE-2026-3616

DefaultFuction Jeson Customer Relationship Management System edit.php sql injection

State: Published
Severity: 5.3 Medium
Published: Mar 6, 2026
Updated: Mar 9, 2026
Reserved: Mar 5, 2026

Description

A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/customers/edit.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named f0e991870e9d33701cca3a1d0fd4eec135af01a6. It is suggested to install a patch to address this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-89 SQL Injection
CWE-74 Injection

Affected Products

Product	Versions
Jeson Customer Relationship Management SystemDefaultFuction	1.0.0Affected

References

VDB-349234 | DefaultFuction Jeson Customer Relationship Management System edit.php sql injectionvdb-entrytechnical-description
VDB-349234 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #765096 | DefaultFuction Jeson CRM V1.0.0 SQL Injectionthird-party-advisory
https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1issue-tracking
https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issuecomment-3982939567issue-tracking
https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/1#issue-3972001812exploitissue-tracking
https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f0e991870e9d33701cca3a1d0fd4eec135af01a6patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.