Daybydaycrm

A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1. Affected is an unknown function of the component Setting Handler. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. It is recommended to apply a patch to fix this issue.

Published: 2026-06-01T18:45:12.856Z
Updated: 2026-06-02T12:41:42.987Z

A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsController.php. Such manipulation leads to improper authorization. The attack may be launched remotely. It is best practice to apply a patch to resolve this issue.

Published: 2026-06-01T18:30:13.342Z
Updated: 2026-06-01T19:36:10.308Z

In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.

Published: 2022-01-13T08:35:13.633Z
Updated: 2024-09-17T02:31:21.087Z

In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.

Published: 2022-01-13T08:35:12.079Z
Updated: 2024-09-16T23:35:56.740Z

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.

Published: 2022-01-05T15:05:22.000Z
Updated: 2024-08-03T03:00:55.383Z