4 results (0.003 seconds)

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-38335

https://notcve.org/view.php?id=CVE-2022-38335

Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules. Se ha detectado que Vtiger CRM versión v7.4.0, contiene una vulnerabilidad de tipo cross-site scripting (XSS) almacenado por medio de los módulos e-mail template • https://code.vtiger.com/vtiger/vtigercrm https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220328-01_Vtiger_CRM_Stored_Cross-Site_Scripting https://www.vtiger.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2019-19202

https://notcve.org/view.php?id=CVE-2019-19202

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request. En Vtiger versiones 7.x anteriores a 7.2.0, la funcionalidad de guardado en My Preferences permite a un usuario sin privilegios administrativos cambiar su propio rol agregando roleid=H2 a una petición POST. • http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html https://code.vtiger.com/vtiger/vtigercrm/issues/1126 • CWE-276: Incorrect Default Permissions •

CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1

CVE-2019-11057

https://notcve.org/view.php?id=CVE-2019-11057

SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. La vulnerabilidad de la inyección de SQL en Vtiger CRM antes de la revisión 7.1.03 permite a los usuarios autenticados ejecutar comandos SQL arbitrarios. • http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html https://cybersecurityworks.com/zerodays/cve-2019-11057-vtiger.html https://medium.com/%40mohnishdhage/sql-injection-vtiger-crm-v7-1-0-cve-2019-11057-245f84fc5c2c • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.2EPSS: 7%CPEs: 2EXPL: 2

CVE-2019-5009 – Vtiger CRM 7.1.0 - Remote Code Execution

https://notcve.org/view.php?id=CVE-2019-5009

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "<? ?>" tags, as demonstrated by a CompanyDetailsSave action. This bypasses the bad-file-extensions protection mechanism. • https://www.exploit-db.com/exploits/46065 http://code.vtiger.com/vtiger/vtigercrm/commit/52fc2fb520ddc55949c2fbedaabd61ddd0109375 http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-January/037852.html https://pentest.com.tr/exploits/Vtiger-CRM-7-1-0-Remote-Code-Execution.html • CWE-434: Unrestricted Upload of File with Dangerous Type •