CVE-2022-22112

2022-01-1309:15:07

Google

osv.dev

7.5 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

21.6%

JSON

In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.

CPENameOperatorVersion
daybydaycrmeq1.1.1
daybydaycrmeq1.1
daybydaycrmeq1.3.1
daybydaycrmeq1.2
daybydaycrmeq1.3.3
daybydaycrmeq1.1.4
daybydaycrmeq1.3.5
daybydaycrmeq1.3.4
daybydaycrmeq1.1.6
daybydaycrmeq1.1.5

Name	Operator	Version
daybydaycrm	eq	1.1.1
daybydaycrm	eq	1.1
daybydaycrm	eq	1.3.1
daybydaycrm	eq	1.2
daybydaycrm	eq	1.3.3
daybydaycrm	eq	1.1.4
daybydaycrm	eq	1.3.5
daybydaycrm	eq	1.3.4
daybydaycrm	eq	1.1.6
daybydaycrm	eq	1.1.5