Description
Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on the Notifications page.
Remediation
References
Related Vulnerabilities
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-6098)
XWikiplatform Other Vulnerability (CVE-2024-46978)
Joomla! Core Cross-Site Scripting (1.6.0 - 3.6.0)
WordPress Plugin The Events Calendar Cross-Site Scripting (4.8.1)
WordPress Plugin Galleries by Angie Makes Cross-Site Scripting (1.67)