CVE-2020-28956

Published: Oct 22, 2021Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.

Affected (1)

Products: Sugarcrm: Sugarcrm

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sugarcrm Sugarcrm	Version 6.5.18

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.vulnerability-lab.com/get_content.php?id=2249

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.vulnerability-lab.com/get_content.php?id=2249

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.