CVE-2013-7249: Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sen...

Security readout for executives and security teams

Fat Free CRM before 0.12.1 could expose sensitive CRM data because XML responses were not properly restricted. A remote requester could ask for serialized records and receive information that should not be public. The sources do not provide CVSS scoring or evidence of active exploitation. Exposure is most likely where an old Fat Free CRM instance, earlier than 0.12.1, is reachable by untrusted users or the internet. Risk is higher if CRM records include user, customer, sales, or operational data. Prioritize remediation if any affected Fat Free CRM instance is externally reachable or stores customer, user, or sales data. This is an older vulnerability, but exposed legacy CRM systems can still create meaningful confidentiality risk. Mitigation focus: Upgrade Fat Free CRM to 0.12.1 or later, following upstream security guidance.; Apply the vendor commit or release fix if full upgrade is not immediately possible.; Restrict public access to legacy CRM routes until remediation is complete..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.