Vulnerabilities > X2Engine > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-10-14 | CVE-2024-48120 | Cross-site Scripting vulnerability in X2Engine X2Crm 8.5 X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. | 5.4 |
| 2022-03-16 | CVE-2021-33853 | Cross-site Scripting vulnerability in X2Engine X2Crm 8.0 A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. | 5.4 |
| 2021-04-14 | CVE-2021-27288 | Cross-site Scripting vulnerability in X2Engine X2Crm 7.1 Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Comment" field in "/profile/activity" page. | 6.1 |
| 2021-04-14 | CVE-2020-21088 | Cross-site Scripting vulnerability in X2Engine X2Crm Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "First Name" and "Last Name" fields in "/index.php/contacts/create page" | 4.8 |
| 2021-04-14 | CVE-2020-21087 | Cross-site Scripting vulnerability in X2Engine X2Crm Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool. | 6.1 |