Rukovoditel vulnerabilities

Products

• Rukovoditel 52
• Project Management App 1
• Rukovoditel CRM 1

Latest Rukovoditel CVEs

Newest publication first · page 1 of 3

1. CVE-2026-31845 Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

   Published 2026-04-11

   Critical·CVSS 9.3 EPSS 0.43%

   A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response wit...

2. CVE-2023-53913 Rukovoditel 3.3.1 CSV Injection via User Account Export

   Published 2025-12-17

   Medium·CVSS 6.2 EPSS 0.73%

   Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV file.

3. CVE-2023-53898 Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Configuration

   Published 2025-12-16

   Medium·CVSS 5.1 EPSS 0.25%

   Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert iframe and script payloads in application copyright text to execute arbitrary JavaScript in victim browsers.

4. CVE-2023-53897 Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments

   Published 2025-12-16

   Medium·CVSS 5.1 EPSS 0.25%

   Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert XSS payloads in project task comments to execute arbitrary JavaScript in victim browsers.

5. CVE-2024-34468 Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.

   Published 2024-05-04

   Medium·CVSS 6.1 EPSS 0.34%

   Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.

6. CVE-2024-34469 Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.

   Published 2024-05-04

   High·CVSS 7.1 EPSS 0.59%

   Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.

7. CVE-2022-48175 Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.

   Published 2023-01-30

   Critical·CVSS 9.8 EPSS 1.8%

   Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.

8. CVE-2022-45020 Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cau...

   Published 2022-12-05

   High·CVSS 8.8 EPSS 0.63%

   Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

9. CVE-2022-44949 Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability all...

   Published 2022-12-02

   Medium·CVSS 5.4 EPSS 1.0%

   Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj...

10. CVE-2022-44946 Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows....

    Published 2022-12-02

    Medium·CVSS 5.4 EPSS 1.1%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecte...

11. CVE-2022-44952 Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary....

    Published 2022-12-02

    Medium·CVSS 5.4 EPSS 0.99%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field...

12. CVE-2022-44945 Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.

    Published 2022-12-02

    Critical·CVSS 9.8 EPSS 0.95%

    Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.

13. CVE-2022-44951 Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability a...

    Published 2022-12-02

    Medium·CVSS 5.4 EPSS 1.0%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload i...

14. CVE-2022-44947 Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerabili...

    Published 2022-12-02

    Medium·CVSS 5.4 EPSS 1.1%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted paylo...

15. CVE-2022-44944 Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability...

    Published 2022-12-02

    Medium·CVSS 5.4 EPSS 1.1%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

16. CVE-2022-44948 Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows att...

    Published 2022-12-02

    Medium·CVSS 5.4 EPSS 0.98%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected i...

17. CVE-2022-44950 Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability all...

    Published 2022-12-02

    Medium·CVSS 5.4 EPSS 1.0%

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj...

18. CVE-2022-43288 Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.

    Published 2022-11-14

    High·CVSS 8.8 EPSS 0.99%

    Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.

19. CVE-2022-43169 A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbit...

    Published 2022-10-28

    Medium·CVSS 5.4 EPSS 1.2%

    A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter...

20. CVE-2022-43164 A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scrip...

    Published 2022-10-28

    Medium·CVSS 5.4 EPSS 1.1%

    A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking...

21. CVE-2022-43166 A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scr...

    Published 2022-10-28

    Medium·CVSS 5.4 EPSS 1.1%

    A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicki...

22. CVE-2022-43170 A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute ar...

    Published 2022-10-28

    Medium·CVSS 5.4 EPSS 1.1%

    A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parame...

23. CVE-2022-43165 A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scr...

    Published 2022-10-28

    Medium·CVSS 5.4 EPSS 1.1%

    A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after click...

24. CVE-2022-43168 Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

    Published 2022-10-28

    Critical·CVSS 9.8 EPSS 1.1%

    Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

25. CVE-2022-43167 A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary we...

    Published 2022-10-28

    Medium·CVSS 5.4 EPSS 1.2%

    A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.