CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-8867 – Perfex CRM Parameter Clients.php cross site scripting
https://notcve.org/view.php?id=CVE-2024-8867
15 Sep 2024 — A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers/Clients.php of the component Parameter Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. • https://bytium.com/stored-cross-site-scripting-xss-vulnerability-in-perfex-crm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-39304 – ChurchCRM SQL Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-39304
26 Jul 2024 — ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQL statements directly into the database query due to inadequate sanitization of the EID parameter in in a GET request to `/GetText.php`. Version 5.9.2 patches the issue. • https://github.com/apena-ba/CVE-2024-39304 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15950
https://notcve.org/view.php?id=CVE-2019-15950
16 Sep 2019 — The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data. El plugin CRM versiones anteriores a 4.2.4 para Redmine, permite un ataque de tipo XSS por medio de datos vCard diseñados. • https://github.com/zerohax/RedmineUP-XSS/blob/master/vcard-upload-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •