CVE-2026-36341

Webkul Krayin CRM version 2.1.5 is vulnerable to a Cross-Site Scripting (XSS) vulnerability (specifically HTML injection) due to the failure to sanitize user-supplied input in the comment field. This occurs during Activity creation on the /admin/activities/create endpoint. An attacker could injec...

Cross-site Scripting (XSS)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS in the markDownToHTML function. An attacker can execute arbitrary JavaScript in the context of another user's browser session by crafting ...

CVE-2025-61196

An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter...

EUVD-2025-37045

An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments unput parameter...

CVE-2025-61196

An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter...

BusinessNext CRMnext 安全漏洞

BusinessNext CRMnext is a customer management platform from BusinessNext India. A security vulnerability exists in BusinessNext CRMnext version 10.8.3.0, which stems from improper handling of the comments input parameter and could lead to remote execution of arbitrary code...

CVE-2025-61196: Improper Control of Generation of Code

An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter...

CVE-2025-61196

An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter...

CVE-2025-61196

A remote code execution (RCE) vulnerability exists in BusinessNext CRMnext version 10.8.3.0 . The root cause is the improper handling of the comments input parameter , which allows an attacker to execute arbitrary code on the target system. To mitigate this risk, it is recommended to update to a ...

PT-2025-44435

Name of the Vulnerable Software and Affected Versions BusinessNext CRMnext version 10.8.3.0 Description An issue in BusinessNext CRMnext version 10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter. The issue involves the comments parameter, which can be...

CVE-2022-22791

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...

Nextcloud: HTML injection with AutoComplete suggestions

As user1 set your displayname to Name 2. As user2 autocomplete the name in the comments input or Talk chat input 3. Click on the user name you just autocompleted User2 is redirected to https://nextcloud.com Only works with HTML, not with script Impact User1 can trick user2 to render any html...