GHSA-wcfx-3m6v-4frgMedium

Fat Free CRM subject to Cross-site Scripting

Published
May 17, 2022
Last Modified
January 23, 2023

🔗 CVE IDs covered (1)

CVE-2014-5441 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.

🎯 Affected products1

  • rubygems/fat_free_crm:>= 0.11.1, < 0.13.3

🔗 References (5)