High severity8.8NVD Advisory· Published Feb 6, 2020· Updated Jun 17, 2026

CVE-2015-6000

Description

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Vtiger/Vtigercrm2 versions
cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:vtiger:vtiger_crm:*:*:*:*:*:*:*:*range: <=6.3.0
- (no CPE)range: 6.3.0 and earlier
Vtiger/vTigerllm-fuzzy
Range: <=6.3.0

Patches

Vulnerability mechanics

References

b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.htmlnvdExploitThird Party Advisory
www.securityfocus.com//archive/1/536563/100/0/threadednvdExploitThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/38345/nvdExploitThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.032
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000