Description
An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
Remediation
References
Related Vulnerabilities
WordPress Plugin Bilingual Linker Cross-Site Scripting (2.1.1)
Liferay version older than 7.1
Jetty Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-22201)
e107 Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-1989)
SharePoint Download of Code Without Integrity Check Vulnerability (CVE-2020-1453)