SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields.
References
Link | Resource |
---|---|
https://www.vulnerability-lab.com/get_content.php?id=2257 | Exploit Third Party Advisory |
Configurations
History
28 Oct 2021, 16:55
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:sugarcrm:sugarcrm:6.5.18:*:*:*:*:*:*:* | |
CWE | CWE-79 | |
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.4 |
References | (MISC) https://www.vulnerability-lab.com/get_content.php?id=2257 - Exploit, Third Party Advisory |
22 Oct 2021, 20:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-10-22 20:15
Updated : 2024-02-04 22:08
NVD link : CVE-2020-28955
Mitre link : CVE-2020-28955
CVE.ORG link : CVE-2020-28955
JSON object : View
Products Affected
sugarcrm
- sugarcrm
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')