X2engine
8 CVEs across 2 X2engine products. Browse X2engine vulnerabilities, severities, and proof-of-concept exploits.
X2engine products with known CVEs
X2engine CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2024-48120 | Medium | 5.4 | 2024-10-14 | X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name"… |
CVE-2022-48178 | Medium | 5.4 | 2023-04-15 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an inde… |
CVE-2022-48177 | Medium | 5.4 | 2023-04-15 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records… |
CVE-2021-33853 | Medium | 5.4 | 2022-03-16 | A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As th… |
CVE-2021-27288 | Medium | 6.1 | 2021-04-14 | Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Co… |
CVE-2020-21088 | Medium | 4.8 | 2021-04-14 | Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML v… |
CVE-2020-21087 | Medium | 6.1 | 2021-04-14 | Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the… |
CVE-2014-2664 | High | 8.8 | 2017-10-17 | Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM befo… |
CVE-2015-5076 | | | 2015-09-29 | Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ve… |
CVE-2015-5075 | | | 2015-09-29 | Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for request… |
CVE-2015-5074 | | | 2015-09-29 | Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows r… |
CVE-2014-5298 | | | 2014-10-10 | FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and… |
CVE-2014-5297 | | | 2014-10-10 | The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object inject… |
CVE-2013-5693 | | | 2013-09-30 | Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to… |
CVE-2013-5692 | | | 2013-09-30 | Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a… |