Ultimate Project Manager
by Rise Ultimate Project Manager
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-17999 | Cri | 0.67 | 9.8 | 0.03 | Jan 23, 2018 | SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.php/knowledge_base/get_article_suggestion/. | ||
| CVE-2019-18884 | Hig | 0.57 | 8.8 | 0.01 | Nov 13, 2019 | index.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users. | ||
| CVE-2020-37004 | Hig | 0.53 | 8.2 | 0.00 | Jan 29, 2026 | The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users database table. Attackers can exploit the /frontend/get_article_suggestion/ endpoint by crafting… | ||
| CVE-2025-60378 | Hig | 0.53 | 8.1 | 0.01 | Oct 10, 2025 | Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft,… | ||
| CVE-2017-11182 | Med | 0.35 | 5.4 | 0.01 | Jul 12, 2017 | In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable. | ||
| CVE-2017-11181 | Med | 0.35 | 5.4 | 0.01 | Jul 12, 2017 | In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable. |
- risk 0.67cvss 9.8epss 0.03
SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.php/knowledge_base/get_article_suggestion/.
- risk 0.57cvss 8.8epss 0.01
index.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users.
- risk 0.53cvss 8.2epss 0.00
The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users database table. Attackers can exploit the /frontend/get_article_suggestion/ endpoint by crafting…
- risk 0.53cvss 8.1epss 0.01
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft,…
- risk 0.35cvss 5.4epss 0.01
In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable.
- risk 0.35cvss 5.4epss 0.01
In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable.