Multiple vtenext Flaws Allow Authentication Bypass and Remote Code Execution

## Executive Summary The report documents multiple critical authentication-bypass vulnerabilities in Vtenext CRM (version 25.02 and earlier) that allow unauthenticated remote account takeover and RCE via three vectors (reflected XSS with CSRF/HTTP-method tampering for session hijack, XSS plus SQL injection to extract password-reset tokens, and an unauthenticated password-reset endpoint). Although a silent fix for the most severe vector (Vector 3) was released in 25.02.1, remaining flaws (Vectors 1 and 2) continue to expose deployments worldwide; immediate upgrade and security review are strongly advised.