CVE-2017-9366

Telaxus EPESI 1.8.2 and earlier is affected by a Stored XSS in modules/Base/Dashboard/Dashboard_0.php via a crafted tab_name parameter. Affected product: EPESI (Polish open-source CRM) versions up to 1.8.2.1. Root cause: input in tab_name not properly sanitized, enabling injection of arbitrary sc...