CVE-2026-7783 - CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection

Back Back to CVE browser

MEDIUM

CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection

Published May 4, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.32%

Description

A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanban.php of the component Admin Kanban Endpoint. This manipulation of the argument this causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Affected products

Vendor CodeCanyon Product Perfex CRM Default
n/a
- Version
  3.4.0
  Status
  affected
  Constraints
  -
- Version
  3.4.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

CodeCanyon

Perfex CRM

n/a

Version	Status	Constraints
3.4.0	affected	-
3.4.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (5)

https://bytium.com/insights/blind-sql-injection-in-perfex-crm-3-4-1
exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-27155
Advisory
https://vuldb.com/submit/807743
third-party-advisory
https://vuldb.com/vuln/360980
vdb-entrytechnical-description
https://vuldb.com/vuln/360980/cti
signaturepermissions-required

Link	Providers	Tags
https://bytium.com/insights/blind-sql-injection-in-perfex-crm-3-4-1		exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-27155		Advisory
https://vuldb.com/submit/807743		third-party-advisory
https://vuldb.com/vuln/360980		vdb-entrytechnical-description
https://vuldb.com/vuln/360980/cti		signaturepermissions-required