CVE-2015-1585: Fatfreecrm Fat Free CRM

Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.

Affected products

• Fatfreecrm Fat Free CRM: up to and including 0.13.5

Published 2015-02-19. Last modified 2026-06-17.