trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation.

Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Path traversal

Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Cross-site scripting (XSS)

Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Privilege escalation

Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Privilege escalation

Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /…

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Privilege escalation

Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• SQL injection

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Broken access control

Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• SQL injection

Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• SQL injection

Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• SQL injection

Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• SQL injection

Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• SQL injection

WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Path traversal

Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Cross-site scripting (XSS)

Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Unrestricted file upload

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Cross-site request forgery (CSRF)

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Cross-site request forgery (CSRF)

Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Cross-site scripting (XSS)

Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Broken access control

Groundhogg <= 2.7.9.8 - Missing Authorization to Update License

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Broken access control

Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• Broken access control