CVE-2017-7188

CVE-2017-7188 affects Zurmo 3.1.1 Stable. The vulnerability is a Cross‑Site Scripting (XSS) flaw where a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter can be injected via default/toggleCollapse. This is the exact attack vector described in the CVE entry. The connecte...

CVE-2017-7188: Improper Neutralization of Input During Web Page Generation

Zurmo 3.1.1 Stable allows a Cross-Site Scripting XSS attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse...

PT-2017-17566

Name of the Vulnerable Software and Affected Versions Zurmo version 3.1.1 Description The issue allows for a Cross-Site Scripting XSS attack. This can be achieved by using a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse. Recommendations For...

Zurmo CRM Cross-Site Scripting Vulnerability

Zurmo CRM is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. A cross-site scripting vulnerability exists in Zurmo CRM version 3.0.2. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML via the...

CVE-2015-5365

Cross-site scripting XSS vulnerability in Zurmo CRM 3.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "What's going on?" profile field...

Cross site scripting

Cross-site scripting XSS vulnerability in Zurmo CRM 3.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "What's going on?" profile field...

CVE-2015-5365

Cross-site scripting XSS vulnerability in Zurmo CRM 3.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "What's going on?" profile field...

CVE-2015-5365

CVE-2015-5365 : Zurmo CRM 3.0.2 contains a cross-site scripting (XSS) vulnerability exploitable by remote authenticated users via the "What’s going on?" profile field. The underlying issue is improper input handling in that field, allowing injection of arbitrary web script/HTML. The connected rec...

PT-2015-6871

Name of the Vulnerable Software and Affected Versions Zurmo CRM version 3.0.2 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the What's going on? profile field. This could potentially lead to unauthorized actions on the...

CVE-2015-5365: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Zurmo CRM 3.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "What's going on?" profile field...

Zurmo CRM 3.0.2 Cross Site Scripting

​ Affected software: zurmo crm Type of vulnerability:xss stored URL:zurmo.com http://demo.zurmo.com/ Discovered by: provensec Website: provensec.com version:N/A Proof of concept​ goto profile section http://demo.zurmo.com/demos/stable/app/index.php/home/default and edit the whats going on field...

Multiple Cross-Site Scripting Vulnerabilities in Zurmo CRM

Zurmo CRM is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. Multiple cross-site scripting vulnerabilities exist in Zurmo CRM because it fails to properly filter user-supplied input. An attacker could potentially exploit these...

Zurmo CRM 2.8.5 Multiple Reflected Cross Site Scripting Vulnerabilities

Zurmo CRM version 2.8.5 suffers from multiple reflective cross site scripting vulnerabilities. Zurmo CRM 2.8.5 Multiple Reflected Cross-Site Scripting Vulnerabilities Vendor: Zurmo Inc. Product web page: http://www.zurmo.org Affected version: 2.8.5 Summary: Zurmo is an Open Source Customer...

Zurmo CRM 2.8.5 Multiple Reflected Cross-Site Scripting Vulnerabilities

Summary Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. Description Zurmo CRM suffers from multiple reflected cross-site scripting vulnerabilities. The issues are triggered when input passed via several GET parameters to several scrip...

Zurmo CRM 2.8.5 Cross Site Scripting

Zurmo CRM 2.8.5 Multiple Reflected Cross-Site Scripting Vulnerabilities Vendor: Zurmo Inc. Product web page: http://www.zurmo.org Affected version: 2.8.5 Summary: Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. Desc: Zurmo CRM suffers...

Zurmo CRM - 储存型XSS

No description provided by source. Affected software: Zurmo CRM Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. We use a test-driven methodology for building every part of the application. Type of vulnerability: XSS Stored URL:...

Zurmo CRM - Persistent XSS Vulnerability

Exploit for php platform in category web applications Affected software: Zurmo CRM Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. We use a test-driven methodology for building every part of the application. Type of vulnerability: XSS...

Zurmo CRM - Persistent Cross-Site Scripting

Zurmo CRM - Persistent Cross-Site Scripting Affected software: Zurmo CRM Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. We use a test-driven methodology for building every part of the application. Type of vulnerability: XSS Stored UR...

Zurmo CRM - Persistent Cross-Site Scripting

Affected software: Zurmo CRM Zurmo is an Open Source Customer Relationship Management CRM application that is mobile, social, and gamified. We use a test-driven methodology for building every part of the application. Type of vulnerability: XSS Stored URL: zurmo.com Discovered by: Provensec Websit...