CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-8867 – Perfex CRM Parameter Clients.php cross site scripting
https://notcve.org/view.php?id=CVE-2024-8867
A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers/Clients.php of the component Parameter Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. • https://bytium.com/stored-cross-site-scripting-xss-vulnerability-in-perfex-crm https://vuldb.com/?ctiid.277504 https://vuldb.com/?id.277504 https://vuldb.com/?submit.408014 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-39304 – ChurchCRM SQL Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-39304
ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQL statements directly into the database query due to inadequate sanitization of the EID parameter in in a GET request to `/GetText.php`. Version 5.9.2 patches the issue. • https://github.com/apena-ba/CVE-2024-39304 https://github.com/ChurchCRM/CRM/commit/e3bd7bfbf33f01148df0ef1acdb0cf2c2b878b08 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2rh6-gr3h-83j9 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15950
https://notcve.org/view.php?id=CVE-2019-15950
The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data. El plugin CRM versiones anteriores a 4.2.4 para Redmine, permite un ataque de tipo XSS por medio de datos vCard diseñados. • https://github.com/zerohax/RedmineUP-XSS/blob/master/vcard-upload-xss https://www.redmineup.com/pages/plugins/crm/updates • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •