Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Vtiger_crm
(Vtiger)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 64 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-08-29 | CVE-2024-44776 | An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL. | Vtiger_crm | 6.1 | ||
| 2024-08-29 | CVE-2024-44777 | A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. | Vtiger_crm | 9.6 | ||
| 2024-08-29 | CVE-2024-44778 | A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. | Vtiger_crm | 9.6 | ||
| 2024-08-29 | CVE-2024-44779 | A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. | Vtiger_crm | 9.6 | ||
| 2014-02-14 | CVE-2013-7326 | Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) return_url parameter to modules\com_vtiger_workflow\savetemplate.php, or unspecified vectors to (2) deletetask.php, (3) edittask.php, (4) savetask.php, or (5) saveworkflow.php. | Vtiger_crm | N/A | ||
| 2008-09-03 | CVE-2008-3101 | Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the user_password parameter in an Authenticate action to the Users module, as reachable through index.php; or (3) the query_string parameter in a UnifiedSearch action to the Home module, as reachable through index.php. | Vtiger_crm | N/A | ||
| 2019-05-17 | CVE-2019-11057 | SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. | Vtiger_crm | 8.8 | ||
| 2023-09-14 | CVE-2023-38891 | SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php. | Vtiger_crm | 8.8 | ||
| 2022-09-27 | CVE-2022-38335 | Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules. | Vtiger_crm | 5.4 | ||
| 2021-04-29 | CVE-2020-22807 | An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature. | Vtiger_crm | 9.8 |