X2engine

15 CVEs across 2 X2engine products. Browse X2engine vulnerabilities, severities, and proof-of-concept exploits.

X2engine products with known CVEs

ProductCVEs
X2crm13
X2engine2
X2engine CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-48120Medium5.42024-10-14X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name"…
CVE-2022-48178Medium5.42023-04-15X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an inde…
CVE-2022-48177Medium5.42023-04-15X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records…
CVE-2021-33853Medium5.42022-03-16A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As th…
CVE-2021-27288Medium6.12021-04-14Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Co…
CVE-2020-21088Medium4.82021-04-14Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML v…
CVE-2020-21087Medium6.12021-04-14Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the…
CVE-2014-2664High8.82017-10-17Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM befo…
CVE-2015-50762015-09-29Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ve…
CVE-2015-50752015-09-29Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for request…
CVE-2015-50742015-09-29Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows r…
CVE-2014-52982014-10-10FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and…
CVE-2014-52972014-10-10The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object inject…
CVE-2013-56932013-09-30Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to…
CVE-2013-56922013-09-30Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a…