564 matches found
CVE-2019-14349: Improper Neutralization of Input During Web Page Generation
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user...
CVE-2019-14350: Improper Neutralization of Input During Web Page Generation
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation...
PT-2019-13629
Name of the Vulnerable Software and Affected Versions EspoCRM version 5.6.4 Description The issue is related to stored XSS due to the lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during the...
PT-2019-13613
Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.6 Description An issue exists due to the lack of filtration of user-supplied data in the Create User function, allowing stored XSS. A malicious attacker can modify the firstName and lastName fields to contain...
CVE-2019-14331: Improper Neutralization of Input During Web Page Generation
An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code...
PT-2019-13630
Name of the Vulnerable Software and Affected Versions EspoCRM version 5.6.4 Description The issue allows a malicious authenticated attacker to brute-force a user password hash by 1 symbol at a time. This is achieved using specially crafted "api/v1/User?filterList" filters. Recommendations For...
CVE-2019-14330: Improper Neutralization of Input During Web Page Generation
An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code...
PT-2019-13612
Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.6 Description A stored XSS issue exists due to the lack of filtration of user-supplied data in Create Case. An attacker can modify the firstName and lastName to contain JavaScript code. Recommendations For version...
EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-30787)
EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM versions prior to 5.6.4, which can be exploited by remote attackers to...
CVE-2019-13643
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...
CVE-2019-13643
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...
Cross site scripting
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...
CVE-2019-13643
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...
CVE-2019-13643
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...
CVE-2019-13643
EspoCRM before 5.6.4 is affected by a stored XSS vulnerability. A malicious payload can be stored in a new stream message and later triggered by clicking a link on the Notifications page, allowing remote execution of JavaScript in the victim’s browser. Root cause is a stored XSS in the stream mes...
CVE-2019-13643: Improper Neutralization of Input During Web Page Generation
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...
CVE-2018-17302
Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /Email/view saved draft message...
CVE-2018-17301
Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /Account in the search panel...