Vulnerability · Published May 4, 2026 · Assigned by VulDB

CVE-2026-7783CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in Perfex CRM from CodeCanyon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 84.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanban.php of the component Admin Kanban Endpoint. This manipulation of the argument this causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Affected products (as reported)

Vendor	Product	Versions
CodeCanyon	Perfex CRM	3.4.03.4.1

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-360980 | CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection vdb-entry, technical-description
VDB-360980 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #807743 | CodeCanyon Perfex CRM 3.4.1 SQL Injection third-party-advisory
https://bytium.com/insights/blind-sql-injection-in-perfex-crm-3-4-1 exploit