Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,808 results · page 24 of 37
Aug 23, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-2829 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-2890 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-1340 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-2885 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).CVE-2021-41924 · Other software · Webkul · reported by MITREMedium 6.1
Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).
- Product
- Krayin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022WP-CRM: Does not validate and sanitise fieldsCVE-2022-1202 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
- Product
- WP-CRM
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WP-CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.CVE-2022-30875 · Other software · Dolibarr · reported by MITREMedium 6.1
Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.CVE-2022-31325 · Other software · Churchcrm · reported by MITREHigh 7.2
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 15, 2022A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the databaseCVE-2021-41965 · Other software · Churchcrm · reported by MITREHigh 8.8
A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN_tyid, theID and EID fields used when an Edit action on an existing record is being performed.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.ioalexbilz.com
May 5, 2022Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-1411 · Other software · yetiforcecompany · reported by security@huntr.devMedium 6.1
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.CVE-2022-27474 · Other software · Salesagility · reported by MITREHigh 7.2
SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email CVE-2021-37517 · Other software · Dolibarr · reported by MITREHigh 7.5
An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statementCVE-2021-36625 · Other software · Dolibarr · reported by MITREHigh 8.8
An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website.CVE-2021-33853 · Other software · X2engine · reported by disclose@cybersecurityworks.comMedium 5.4
A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the user attempts to access any page of the CRM.
- Product
- X2crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comcybersecurityworks.com
Mar 10, 2022SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.CVE-2022-23940 · Other software · Salesagility · reported by MITREHigh 8.8
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Mar 7, 2022Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.CVE-2022-0756 · Other software · salesagility · reported by security@huntr.devMedium 6.5
Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.
- Product
- salesagility/suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.CVE-2022-0755 · Other software · salesagility · reported by security@huntr.devMedium 4.3
Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.
- Product
- salesagility/suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.CVE-2022-0754 · Other software · salesagility · reported by security@huntr.devMedium 6.5
SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.
- Product
- salesagility/suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.CVE-2021-45899 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Jan 28, 2022SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.CVE-2021-45898 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Jan 28, 2022SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.CVE-2021-45897 · Other software · Salesagility · reported by MITREHigh 8.8
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Jan 24, 2022Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.CVE-2022-0269 · Other software · yetiforcecompany · reported by security@huntr.devHigh 8
Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration.CVE-2022-22113 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioHigh 8.8
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 13, 2022In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI).CVE-2022-22112 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioMedium 5.4
In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 12, 2022SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP arCVE-2021-41597 · Other software · Salesagility · reported by MITREHigh 8.8
SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Jan 5, 2022In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization.CVE-2022-22111 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioHigh 8.8
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality.CVE-2022-22110 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioHigh 7.5
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious CVE-2022-22109 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioMedium 5.4
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.CVE-2022-22108 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioMedium 4.3
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 5, 2022In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.CVE-2022-22107 · Other software · Bottelet · reported by vulnerabilitylab@mend.ioMedium 4.3
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
- Product
- DaybydayCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 1, 2022admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.CVE-2022-22293 · Other software · Dolibarr · reported by MITREMedium 5.4
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2021A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to CVE-2021-45903 · Other software · Salesagility · reported by MITREMedium 6.1
A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Dec 19, 2021SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_daCVE-2021-45041 · Other software · Salesagility · reported by MITREHigh 8.8
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_date.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Dec 16, 2021yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4121 · Other software · yetiforcecompany · reported by security@huntr.devMedium 6.1
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021yetiforcecrm is vulnerable to Business Logic ErrorsCVE-2021-4117 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.3
yetiforcecrm is vulnerable to Business Logic Errors
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4116 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021yetiforcecrm is vulnerable to Business Logic ErrorsCVE-2021-4111 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.3
yetiforcecrm is vulnerable to Business Logic Errors
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4107 · Other software · yetiforcecompany · reported by security@huntr.devMedium 6.1
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2021yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4092 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.3
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021OroCRM is an open source Client Relationship Management (CRM) application.CVE-2021-39198 · Other software · oroinc · reported by GitHubMedium 4.2
OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exCVE-2021-33816 · Other software · Dolibarr · reported by MITRECritical 9.8
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgtrovent.github.io
Nov 10, 2021Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-maCVE-2021-33618 · Other software · Dolibarr · reported by MITREMedium 6.1
Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Oct 29, 2021SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php.CVE-2021-41746 · Other software · Yonyou · reported by MITREHigh 7.5
SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. Attackers can use the vulnerabilities to obtain sensitive database information.
- Product
- Turbocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2021Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafCVE-2020-36501 · Other software · Sugarcrm · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter.CVE-2020-28961 · Other software · Perfexcrm · reported by MITREMedium 5.4
Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter.
- Product
- Perfex CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafteCVE-2020-28956 · Other software · Sugarcrm · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module.CVE-2020-28955 · Other software · Sugarcrm · reported by MITREMedium 5.4
SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting.CVE-2021-42840 · Other software · Salesagility · reported by MITREHigh 8.8
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdocs.suitecrm.com
Oct 5, 2021A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website.CVE-2021-33849 · Email & office · Zoho · reported by disclose@cybersecurityworks.comMedium 5.4
A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4.
- Product
- Zoho CRM Lead Magnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comcybersecurityworks.com
Oct 4, 2021SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal.CVE-2021-41596 · Other software · Salesagility · reported by MITREMedium 5.3
SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.