Zurmo 3.2.6 Open Redirection

Open Redirection Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Open Redirection Vulnerability in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Open Redirection Severity: Medium Status: Not Fixed...

Zurmo 3.2.6 Reflected Cross Site Scripting

Reflected Cross-site Scripting Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Reflected Cross-site Scripting in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Reflected Cross-site Scripting Severity:...

Zurmo 3.2.6 Code Evaluation

Code Evaluation Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Code Evaluation Vulnerability in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Code Evaluation Severity: Critical Status: Not Fixed...

Zurmo Code Evolution (PHP) Vulnerability

Zurmo is an open source customer relationship management CRM system developed using PHP. A security vulnerability exists in Zurmo. An attacker can exploit the vulnerability to execute arbitrary code...

Zurmo 2.3.4 Cross Site Scripting

Code Evolution PHP Vulnerability in Zurmo 2.3.4 Information -------------------- Advisory by Netsparker Name: Code Evolution PHP in Zurmo 2.3.4 Affected Software: Zurmo Affected Versions: 2.3.4 Homepage: http://zurmo.org/ Vulnerability: Code evolution PHP Severity: Critical Status: Not Fixed CVSS...

CVE-2018-19506

Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...

CVE-2018-19506

Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...

Design/Logic Flaw

Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...

CVE-2018-19596

Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...

Design/Logic Flaw

Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...

CVE-2018-19596

Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...

CVE-2018-19596

Zurmo 3.2.4 is vulnerable to HTML Injection (XSS) in the reports section via an admin using HTML in the report details (app/index.php/reports/default/details?id=1). ThisCVEdescription maps to CVE-2018-19596 and is related to CVE-2018-19506. The connected documents confirm the affected component a...

CVE-2018-19506

Zurmo 3.2.4 is identified as affected by an XSS vulnerability in the reports module. The issue arises when an admin uses the name parameter in the reports section (URI: app/index.php/reports/default/details?id=1), enabling script injection. The NVD entry for CVE-2018-19506 documents this XSS, wit...

CVE-2018-19596

Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...

CVE-2018-19506

Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...

CVE-2018-16654

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

Design/Logic Flaw

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

CVE-2018-16654

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

CVE-2018-16654

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

CVE-2018-16654

Zurmo 3.2.4 Stable is affected by a cross-site scripting (XSS) vulnerability in the endpoint app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1. The issue allows injection of scripts via crafted URL parameters, escalating potential to modify or exfiltrate data (per CVSS metr...