Approved changes feed: RSS · Atom
cpe:2.3:a:x2engine:x2crm:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | X2Engine (f3217d32-170a-5dc2-a42b-88f25c05dfcc) |
|---|---|
| Product | X2Crm (59e54b49-8c05-506b-ac3e-07ca829b4ba0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/x2engine/x2crm |
purl2cpe | 2026-06-01 10:18:07.337866 |
pkg:sourceforge/x2engine |
purl2cpe | 2026-06-01 10:18:07.337869 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-48120 |
vulnerable | 2026-06-08 06:48:13.623801 |
Details available
X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating a list.
Published: 2024-10-14T00:00:00.000Z
Updated: 2024-10-15T15:22:16.044Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-21088 |
vulnerable | 2026-06-08 05:22:30.693592 | db.gcve.eu details are currently unavailable. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-21087 |
vulnerable | 2026-06-08 05:22:30.692961 |
Details available
Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool.
Published: 2021-04-14T13:49:30.000Z
Updated: 2024-08-04T14:22:25.524Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5076 |
vulnerable | 2026-06-08 05:06:48.735308 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) version parameter in protected/views/admin/formEditor.php; the (2) importId parameter in protected/views/admin/rollbackImport.php; the (3) bc, (4) fg, (5) bgc, or (6) font parameter in protected/views/site/listener.php; the (7) Services[*] parameter in protected/components/views/webForm.php; the (8) file parameter in protected/components/TranslationManager.php; the (9) x2_key parameter in protected/tests/webscripts/x2WebTrackingTestPages/customWebLeadCaptureScriptTest.php; the (10) id parameter in protected/modules/contacts/controllers/ContactsController.php; or the (11) lastEventId parameter to index.php/profile/getEvents.
Published: 2015-09-29T19:00:00.000Z
Updated: 2024-08-06T06:32:32.703Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5075 |
vulnerable | 2026-06-08 05:06:48.734874 |
Details available
Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create.
Published: 2015-09-29T19:00:00.000Z
Updated: 2024-08-06T06:32:32.671Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5074 |
vulnerable | 2026-06-08 05:06:48.734357 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-2664 |
vulnerable | 2026-06-08 05:05:29.498702 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-5693 |
vulnerable | 2026-06-08 05:04:53.097537 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-5692 |
vulnerable | 2026-06-08 05:04:53.082523 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.