X2engine
X2engine X2crm: vulnerabilidades y CVE
X2engine X2crm tiene 13 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE13
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-48120 | Media (5.4) | 0.68% | — | 14 oct 2024 | X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating a list. |
| CVE-2022-48178 | Media (5.4) | 1.8% | — | 15 abr 2023 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI. |
| CVE-2022-48177 | Media (5.4) | 1.8% | — | 15 abr 2023 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows… |
| CVE-2021-33853 | Media (5.4) | 0.58% | — | 16 mar 2022 | A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users… |
| CVE-2021-27288 | Media (6.1) | 0.92% | — | 14 abr 2021 | Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Comment" field in "/profile/activity" page. |
| CVE-2020-21088 | Media (4.8) | 0.76% | — | 14 abr 2021 | Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "First Name" and "Last Name" fields in… |
| CVE-2020-21087 | Media (6.1) | 1.4% | — | 14 abr 2021 | Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool. |
| CVE-2014-2664 | Alta (8.8) | 2.9% | — | 17 oct 2017 | Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote attackers to execute arbitrary code by… |
| CVE-2015-5076 | Media (4.3) | 1.9% | — | 29 sept 2015 | Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) version parameter in protected/views/admin/formEditor.php; the… |
| CVE-2015-5075 | Media (6.8) | 2.8% | — | 29 sept 2015 | Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted… |
| CVE-2015-5074 | Alta (7.5) | 7.5% | — | 29 sept 2015 | Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by… |
| CVE-2013-5693 | Media (4.3) | 3.2% | — | 30 sept 2013 | Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor. |
| CVE-2013-5692 | Alta (8.5) | 5.8% | — | 30 sept 2013 | Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the file parameter to… |