Cross site scripting

An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can modify the parameter name to contain JavaScript code...

CVE-2019-14331

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

CVE-2019-14331

CVE-2019-14331 affects EspoCRM prior to 5.6.6 and describes a stored XSS in Create User via unfiltered user data in firstName/lastName. The vulnerability arises from insufficient input filtration, allowing an attacker to inject JavaScript that could be stored and later executed. Impact per source...

CVE-2019-14330

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

CVE-2019-14330

CVE-2019-14330 affects EspoCRM

CVE-2019-14329

An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can modify the parameter name to contain JavaScript code...

CVE-2019-14329

EspoCRM vulnerability CVE-2019-14329 affects versions before 5.6.6. The issue is stored XSS caused by lack of filtration of user-supplied data in Create Task; a malicious attacker can modify the parameter name to inject JavaScript code. The common disclosures across NVD, Red Hat, CNVD, OSV, and C...

EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-30787)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM versions prior to 5.6.4, which can be exploited by remote attackers to...

CVE-2019-13643

Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...

CVE-2019-13643

Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...

Cross site scripting

Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...

CVE-2019-13643

Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on...

CVE-2019-13643

EspoCRM before 5.6.4 is affected by a stored XSS vulnerability. A malicious payload can be stored in a new stream message and later triggered by clicking a link on the Notifications page, allowing remote execution of JavaScript in the victim’s browser. Root cause is a stored XSS in the stream mes...

CVE-2018-17302

Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /Email/view saved draft message...

CVE-2018-17301

Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /Account in the search panel...

CVE-2018-17302

Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /Email/view saved draft message...

CVE-2018-17301

Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /Account in the search panel...

Cross site scripting

Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /Email/view saved draft message...

Cross site scripting

Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /Account in the search panel...

CVE-2018-17301

CVE-2018-17301 — EspoCRM 5.3.6 has a reflected XSS in the file client/res/templates/global-search/name-field.tpl , exploitable via the /#Account search panel. The vulnerability stems from improper handling of user-supplied input in the global search name field, allowing injection of arbitrary Jav...