X2engine - vulnerabilities (CVEs)
15 CVEs in 2 products, 0 in the last 30 days, newest from 2024-10-14.
Products
Newest CVEs of X2engine
- CVE-2024-48120 - CVSS 6.5 (medium), 2024-10-14: X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the…
- CVE-2022-48177 - CVSS 5.4 (medium), 2023-04-15: X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import…
- CVE-2022-48178 - CVSS 5.4 (medium), 2023-04-15: X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an…
- CVE-2021-33853 - CVSS 5.4 (medium), 2022-03-16: A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As…
- CVE-2020-21087 - CVSS 6.1 (medium), 2021-04-14: Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via…
- CVE-2021-27288 - CVSS 6.1 (medium), 2021-04-14: Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the…
- CVE-2020-21088 - CVSS 4.8 (medium), 2021-04-14: Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML…
- CVE-2014-2664 - CVSS 8.8 (high), 2017-10-17: Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM…
- CVE-2015-5076 - CVSS 4.3 (medium), 2015-09-29: Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1)…
- CVE-2015-5075 - CVSS 6.8 (medium), 2015-09-29: Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for…
- CVE-2015-5074 - CVSS 7.5 (high), 2015-09-29: Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows…
- CVE-2014-5297 - CVSS 7.5 (high), 2014-10-10: The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object…
- CVE-2014-5298 - CVSS 5 (medium), 2014-10-10: FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and…
- CVE-2013-5693 - CVSS 4.3 (medium), 2013-09-30: Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter…
- CVE-2013-5692 - CVSS 8.5 (high), 2013-09-30: Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a…
