Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) version parameter in protected/views/admin/formEditor.php; the (2) importId parameter in protected/views/admin/rollbackImport.php; the (3) bc, (4) fg, (5) bgc, or (6) font parameter in protected/views/site/listener.php; the (7) Services[*] parameter in protected/components/views/webForm.php; the (8) file parameter in protected/components/TranslationManager.php; the (9) x2_key parameter in protected/tests/webscripts/x2WebTrackingTestPages/customWebLeadCaptureScriptTest.php; the (10) id parameter in protected/modules/contacts/controllers/ContactsController.php; or the (11) lastEventId parameter to index.php/profile/getEvents.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
X2Engine X2CRM 跨站脚本漏洞
Vulnerability Description
X2Engine X2CRM是美国X2Engine公司的一套开源的客户关系管理程序（CRM）。 X2Engine X2CRM 5.0.9之前版本中存在跨站脚本漏洞，该漏洞源于protected/views/admin/formEditor.php脚本没有充分过滤‘version’参数；protected/views/admin/rollbackImport.php脚本没有充分过滤‘importId’参数；protected/views/site/listener.php脚本没有充分过滤多个参数（bc，fg
CVSS Information
N/A
Vulnerability Type
N/A