PT-2020-7430

Name of the Vulnerable Software and Affected Versions: vtiger CRM versions 5.4.0 and earlier Description: The issue is related to a PHP Code Injection Vulnerability in the 'vtigerolservice.php' file. This vulnerability allows for the injection of PHP code, potentially leading to unauthorized acce...

CVE-2013-3212: Improper Neutralization of Special Elements in Output Used by a Downstream Component

vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local script code...

CVE-2013-3214: Improper Neutralization of Special Elements in Output Used by a Downstream Component

vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'...

PT-2020-7429

Name of the Vulnerable Software and Affected Versions: vtiger CRM versions 5.4.0 and earlier Description: The issue allows remote attackers to view files and execute local script code due to local file-include vulnerabilities in the customerportal.php file. Recommendations: For versions 5.4.0 and...

Vtiger CRM Elevation of Privilege Vulnerability

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. A security vulnerability exists in the My Preferences saving feature i...

CVE-2019-19202

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request...

CVE-2019-19202

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request...

Cross site request forgery (csrf)

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request...

CVE-2019-19202

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request...

CVE-2019-19202

Vulnerability CVE-2019-19202 affects Vtiger CRM 7.x prior to 7.2.0. A My Preferences POST request flaw allows a user without administrative privileges to elevate themselves by adding roleid=H2, enabling an unwanted change to their own role. This constitutes an elevation of privilege with potentia...

PT-2019-15781

Name of the Vulnerable Software and Affected Versions Vtiger versions prior to 7.2.0 Description The issue concerns the My Preferences saving functionality, which allows a user without administrative privileges to change their own role. This can be achieved by adding roleid=H2 to a POST request...

CVE-2019-19202: Incorrect Default Permissions

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request...

Vtiger CRM Cross-Site Scripting Vulnerability (CNVD-2019-17134)

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. A cross-site scripting vulnerability exists in Vtiger CRM versions pri...

CVE-2018-8047

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

Cross site scripting

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

CVE-2018-8047

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

CVE-2018-8047

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

CVE-2018-8047

Vulnerability: vtiger CRM 7.0.1 is affected by a reflected Cross-Site Scripting (XSS) flaw. Root cause: lack of proper input validation in the app parameter passed via index.php?module=Contacts&view=List, enabling remote unauthenticated users to inject script/HTML. Affected versions: 7.0.1 and pr...

CVE-2018-8047: Improper Neutralization of Input During Web Page Generation

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

PT-2019-11144

Name of the Vulnerable Software and Affected Versions: vtiger CRM versions prior to 7.0.1 Description: The issue is a reflected Cross-Site Scripting XSS vulnerability that could allow remote unauthenticated attackers to inject arbitrary web script or HTML via the...