Cross site scripting

A persistent cross-site scripting XSS issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268...

CVE-2021-39267

CVE-2021-39267 describes a persistent cross-site scripting (XSS) vulnerability in the SuiteCRM web interface. The issue allows a remote attacker to inject arbitrary JavaScript by uploading files, due to a Content-Type Filter bypass where text/html is blocked but other types capable of executing J...