Description

Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.

Remediation

References

CVE-2020-28956

Related Vulnerabilities

WebLogic CVE-2020-2547 Vulnerability (CVE-2020-2547)

Oracle Database Server CVE-2021-2175 Vulnerability (CVE-2021-2175)

WordPress Plugin Ecwid Ecommerce Shopping Cart PHP Object Injection (4.4.3)

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-9788)

PHP Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Vulnerability (CVE-2001-1246)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2020-28956