Stored Cross-site Scripting (XSS)

yetiforce/yetiforce-crm is vulnerable to stored cross-site scriptingXSS attacks. The library does not properly escape the content of title parameter in WidgetsManagement module and it is used directly without any encoding or validation on ChartFilter.tpl, allowing an attacker to inject and execut...

GHSA-2QF8-H7PR-X2R8 YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module

YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the WidgetsManagement module. A patch is available at commit b716ecea340783b842498425faa029800bd30420...

PT-2022-19489 · Yetiforce · Yetiforcecrm

Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.3 YetiForce CRM versions 6.4.0 and prior Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository yetiforcecompany/yetiforcecrm. The WidgetsManagement module...

YetiForceCrm 跨站脚本漏洞

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site scripting vulnerability exists in versions of YetiForceCrm prior to 6.3, which stems from an unvalidated title parameter on the WidgetsManagement module in Settings and is used directly in...

Persistent Cross Site Scripting - WidgetsManagement Module - Settings

Description The application uses Purifier to avoid the Cross Site Scripting attack. However, On WidgetsManagement module from Settings, the "title"parameter is not validated and it's used directly without any encoding or validation on Vitger/dashboards/ChartFilter.tpl. It allows attacker to injec...