CVE-2011-4680: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4679: Undefined Security Weakness

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

PT-2011-5026

Name of the Vulnerable Software and Affected Versions vtiger CRM versions prior to 5.2.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the customer portal of vtiger CRM. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via...

PT-2011-5025

Name of the Vulnerable Software and Affected Versions vtiger CRM versions prior to 5.3.0 Description The issue allows remote authenticated users to bypass intended access restrictions. This is due to the software not properly recognizing the disabled status of a field in the Leads module, enablin...

CVE-2011-4670

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...

CVE-2011-4670

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...

CVE-2011-4670

CVE-2011-4670 affects vtiger CRM up to version 5.2.1 (and earlier per sources) where multiple XSS vectors exist in the Calendar, DetailView, EditView, ListView, and other modules (Calendar, Campaigns, com_vtiger_workflow, Dashboard, Potentials, Reports, Settings, Home, phprint.php). The root caus...

PT-2011-5017

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 5.2.1 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different modules, including Calendar, Campaigns, com vtiger workflow, Dashboard, Potentials,...

CVE-2011-4670: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...

Sql injection

SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php...

CVE-2011-4559

SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php...

CVE-2011-4559

CVE-2011-4559 affects vtiger CRM (Calendar module) prior to or including vTiger 5.2.1; the vulnerability is a SQL injection in the onlyforuser parameter of the index action (index.php). This allows remote attackers to execute arbitrary SQL commands. Connected records also indicate CVE-2013-5091 a...

CVE-2011-4559: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php...

PT-2011-4987

Name of the Vulnerable Software and Affected Versions vTiger CRM versions 5.2.1 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the onlyforuser parameter in an index action to the "index.php" endpoint. Recommendations For...

vtiger CRM 5.2.1 Cross Site Scripting

vtiger CRM 5.2.1 Multiple Remote Cross-Site Scripting Vulnerabilities Vendor: vTiger Product web page: http://www.vtiger.com Affected version: 5.2.1 Summary: vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support...

vTiger CRM 5.2.1 - index.php Multiple Cross-Site Scripting Vulnerabilities (2)

vTiger CRM 5.2.1 - index.php Multiple Cross-Site Scripting Vulnerabilities 2 source: https://www.securityfocus.com/bid/50364/info vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues t...

vtiger CRM 5.2.1 Multiple Remote Cross-Site Scripting Vulnerabilities

Summary vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. Description vtiger CRM suffers from a XSS vulnerability when parsing user input to the...

Local File Inclusion Vulnerabilities in vtiger CRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in vtiger CRM which could be exploited to perform gain access to sensitive information and compromise vulnerable system. 1 Local file inclusion vulnerabilities in vtiger CRM 1.1 The vulnerability exists due to input...

vTiger CRM 5.2 - onlyforuser SQL Injection

vTiger CRM 5.2 - onlyforuser SQL Injection source: https://www.securityfocus.com/bid/49948/info vtiger CRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...