CVE-2020-28955

SugarCRM v6.5.18 was discovered to contain a cross-site scripting XSS vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields...

CVE-2020-28955

SugarCRM v6.5.18 contains a cross-site scripting (XSS) vulnerability in the Create Employee module. The flaw allows arbitrary web scripts/HTML via crafted payloads in the First Name or Last Name input fields. Connected sources confirm the affected version and vulnerable inputs; no explicit exploi...