Cross-site Scripting in OpenCRX

OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field...

CVE-2023-40814

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field...

CVE-2023-40810

OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field...

CVE-2023-40809

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number...

Design/Logic Flaw

OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field...

Design/Logic Flaw

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field...

Input validation

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number...

Design/Logic Flaw

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field...

Design/Logic Flaw

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field...

CVE-2023-40809

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number...

CVE-2023-40813

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation...

PT-2023-27649 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX version 5.2.0 Description: The issue allows for HTML injection via the Accounts Group Name Field. Recommendations: For OpenCRX version 5.2.0, update to a version that fixes this issue, or as a temporary workaround, consider validating...

CVE-2023-40816

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field...

CVE-2023-40815

Summary: OpenCRX 5.2.0 is affected by an HTML injection flaw in the Category Creation Name Field. This issue is repeatedly described as enabling Cross‑Site Scripting (XSS) via the category name input, reflecting a lack of input validation in that field. The available documents identify the vulner...

CVE-2023-40816

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field...

PT-2023-27650 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX version 5.2.0 Description: The issue allows for HTML injection via Activity Saved Search Creation. Recommendations: For OpenCRX version 5.2.0, update to a version that fixes this issue, as no specific workaround is provided for this...

CVE-2023-40817

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field...

CVE-2023-40813

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation...

CVE-2023-40812

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field...

PT-2023-27653 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX version 5.2.0 Description: The issue allows for HTML injection via the Activity Milestone Name Field, which could potentially lead to malicious code execution. Recommendations: For OpenCRX version 5.2.0, update to a newer version that...