Vulnerabilities > X2Engine > X2Crm > 2.9.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-04-14 | CVE-2020-21087 | Cross-site Scripting vulnerability in X2Engine X2Crm Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool. | 4.3 |
| 2017-10-17 | CVE-2014-2664 | Unrestricted Upload of File with Dangerous Type vulnerability in X2Engine X2Crm Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory. | 6.5 |
| 2015-09-29 | CVE-2015-5076 | Cross-site Scripting vulnerability in X2Engine X2Crm Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) version parameter in protected/views/admin/formEditor.php; the (2) importId parameter in protected/views/admin/rollbackImport.php; the (3) bc, (4) fg, (5) bgc, or (6) font parameter in protected/views/site/listener.php; the (7) Services[*] parameter in protected/components/views/webForm.php; the (8) file parameter in protected/components/TranslationManager.php; the (9) x2_key parameter in protected/tests/webscripts/x2WebTrackingTestPages/customWebLeadCaptureScriptTest.php; the (10) id parameter in protected/modules/contacts/controllers/ContactsController.php; or the (11) lastEventId parameter to index.php/profile/getEvents. | 4.3 |
| 2015-09-29 | CVE-2015-5075 | Cross-Site Request Forgery (CSRF) vulnerability in X2Engine X2Crm Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create. | 6.8 |
| 2015-09-29 | CVE-2015-5074 | Improper Input Validation vulnerability in X2Engine X2Crm Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension. | 7.5 |
| 2013-09-30 | CVE-2013-5693 | Cross-Site Scripting vulnerability in X2Engine X2Crm Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor. | 4.3 |
| 2013-09-30 | CVE-2013-5692 | Path Traversal vulnerability in X2Engine X2Crm Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. | 8.5 |