Ttrainingbusinesspros

Products

Exploited and recent CVEs

• CVE-2026-109221 High 8.1 Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping 0.8%
• CVE-2026-18548 High 7.2 Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter 0.3%
• CVE-2026-92975 High 8.1 Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion 0.3%
• CVE-2026-104725 High 8.8 Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter 0.3%
• CVE-2026-97644 High 8.8 Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test 0.5%
• CVE-2026-18387 Medium 6.5 Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter 0.7%
• CVE-2026-11454 Medium 6.5 Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference 0.5%
• CVE-2026-14029 Medium 6.5 Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter 0.6%
• CVE-2026-13333 Medium 6.5 Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter 0.6%
• CVE-2026-13331 Medium 6.5 Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter 0.5%
• CVE-2026-13226 Medium 6.5 Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter 0.5%
• CVE-2026-4281 Medium 5.3 FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow 0.5%
• CVE-2025-12750 Medium 4.9 Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection 0.3%
• CVE-2025-4206 High 7.2 WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion 1.6%
• CVE-2025-1267 Medium 5.5 Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter 0.4%
• CVE-2025-0394 High 8.8 Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function 1.2%
• CVE-2023-2717 Medium 5.4 Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins 0.3%
• CVE-2023-2736 High 7.5 Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation 0.4%
• CVE-2023-2735 Medium 4.9 Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.5%
• CVE-2023-2716 Medium 5.4 Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload 0.5%
• CVE-2023-2714 Medium 4.3 Groundhogg <= 2.7.9.8 - Missing Authorization to Update License 0.5%
• CVE-2023-2715 Medium 4.3 Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation 0.6%