CVE-2026-112289

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112289

Koalixcrm versions through 1.14.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists because malicious task titles are rendered unescaped by the Task.link_to_task() function. Staff users can inject scripts that execute in the context of an administrator's browser...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

EUVD-2026-104284

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112289: Improper Neutralization of Input During Web Page Generation

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

KoalixSwitzerland Koalixcrm Cross-site Scripting Vulnerability

KoalixSwitzerland: The Koalixcrm version 1.14.0 and earlier have a cross-site scripting vulnerability. This vulnerability arises from the fact that the Task.linktotask function does not escape the rendered task titles. This allows for storage-type cross-site scripting attacks, potentially allowin...