CVE-2022-22109GHSA-JR37-66PJ-36V7
DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.2.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
Timeline
- CVE published
- Record last updated
Affected versions
- Bottelet DaybydayCRM
2.2.0
- Bottelet flarepoint
2.2.0
- bottelet/flarepointPackagist
fixed in 2.2.1