Administrative Interface Vulnerability in go2ismail Free-CRM
CVE-2026-3264

5.3MEDIUM

Key Information:

Vendor

Go2ismail

Status
Free-crm
Vendor
CVE Published:
26 February 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-3264?

A security flaw has been identified in the Administrative Interface of go2ismail Free-CRM, allowing for exploitation through manipulation of certain functionalities. This vulnerability can be remotely executed, leading to unauthorized actions predicated on execution after a redirect. Although the specifics of the affected functionalities remain unspecified, the potential for misuse has been publicly acknowledged. The ongoing rolling release model of the product complicates tracking of version-specific vulnerabilities, as the vendor has not responded to initial disclosure attempts regarding this issue.

Affected Version(s)

Free-CRM b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-3264 - Proof of Concept

References

https://vuldb.com/?id.347987
vdb-entry
https://vuldb.com/?ctiid.347987
signaturepermissions-required
https://vuldb.com/?submit.758337
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ghufran Khan (VulDB User)
VulDB
.