X2crm
X2engine · 13 CVEs
X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject m…
Oct 14, 2024
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via…
Apr 15, 2023
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability…
Apr 15, 2023
A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser…
Mar 16, 2022
Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by…
Apr 14, 2021
Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by inject…
Apr 14, 2021
Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting…
Apr 14, 2021
Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/Prof…
Oct 17, 2017
Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arb…
Sep 29, 2015
Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the auth…
Sep 29, 2015
Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php…
Sep 29, 2015
Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web s…
Sep 30, 2013
Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include an…
Sep 30, 2013
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2024-48120 | X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name"… | MEDIUM | 0.68% | Oct 14, 2024 |
| CVE-2022-48178 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an inde… | MEDIUM | 1.83% | Apr 15, 2023 |
| CVE-2022-48177 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records… | MEDIUM | 1.83% | Apr 15, 2023 |
| CVE-2021-33853 | A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As th… | MEDIUM | 0.58% | Mar 16, 2022 |
| CVE-2020-21088 | Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML v… | MEDIUM | 0.76% | Apr 14, 2021 |
| CVE-2020-21087 | Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the… | MEDIUM | 1.35% | Apr 14, 2021 |
| CVE-2021-27288 | Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Co… | MEDIUM | 0.92% | Apr 14, 2021 |
| CVE-2014-2664 | Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM befo… | HIGH | 2.91% | Oct 17, 2017 |
| CVE-2015-5076 | Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ve… | MEDIUM | 1.91% | Sep 29, 2015 |
| CVE-2015-5075 | Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for request… | MEDIUM | 2.76% | Sep 29, 2015 |
| CVE-2015-5074 | Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows r… | HIGH | 7.51% | Sep 29, 2015 |
| CVE-2013-5693 | Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to… | MEDIUM | 3.23% | Sep 30, 2013 |
| CVE-2013-5692 | Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a ..… | HIGH | 5.79% | Sep 30, 2013 |
Showing 1 to 13 of 13 CVEs