CVE-2018-20975

Fat Free CRM before 0.18.1 is vulnerable to Cross‑Site Scripting via the tags_helper.rb logic in app/helpers/tags_helper.rb. The root cause is lack of proper escaping of user-supplied input (notably the query parameter), enabling injection of arbitrary script. Public references (Veracode entry) d...