High severity7.5NVD Advisory· Published Oct 29, 2021· Updated Jun 17, 2026

CVE-2021-41746

Description

SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. Attackers can use the vulnerabilities to obtain sensitive database information.

Affected products

Yonyou/TurboCRM2 versions
cpe:2.3:a:yonyou:turbocrm:-:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:yonyou:turbocrm:-:*:*:*:*:*:*:*
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/purple-WL/Yonyou-TurboCRM-SQL-injection/issues/1nvdExploitThird Party Advisory
www.cnvd.org.cn/flaw/show/CNVD-2020-21956nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000