CVE-2026-15514

Name of the Vulnerable Software and Affected Versions MetaCRM versions prior to 6.4.0 Beta06

Description An issue exists in the PHPRPC Remote Call Interface component within the /customizemt/xkq/rpc.jsp file. A remote attacker can perform a SQL injection by manipulating the phprpc args argument passed to the RPCService.query() function. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the RPCService.query() function or the /customizemt/xkq/rpc.jsp file.