CVE-2020-37004: Codexcube Ultimate Project Manager CRM Pro

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users database table. Attackers can exploit the /frontend/get_article_suggestion/ endpoint by crafting malicious search parameters to progressively guess and retrieve user credentials through boolean-based inference techniques.

Affected products

• Codexcube Ultimate Project Manager CRM Pro: up to and including 2.0.5

Published 2026-01-29. Last modified 2026-06-17.