CVE-2013-7326

vTiger CRM 5.4.0 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) return_url parameter to modules\com_vtiger_workflow\savetemplate.php, or unspecified vectors to (2) deletetask.php, (3) edittask.php, (4) savetask.php, or (5) saveworkflow.php.

References (6)

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2013-12/0052.html

[Third Party Advisory, VDB Entry] http://osvdb.org/100897

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/124402

[URL Repurposed] http://www.enkomio.com/Advisory/SOJOBO-ADV-13-05

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/89662

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/64236

Scores

EPSS 0.0041

EPSS Percentile 60.8%

Details

CWE

CWE-79

Status published

Products (2)

vtiger/vtiger_crm

n/a/n/a

Published Feb 14, 2014

Tracked Since Feb 18, 2026