Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
CVSS Score
6.1
EPSS Score
0.002
Published
2019-08-01
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI.
CVSS Score
4.8
EPSS Score
0.002
Published
2018-12-19
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506.
CVSS Score
4.8
EPSS Score
0.002
Published
2018-12-19