Fatfreecrm: >> Fat Free Crm >> 0.12.1 Security Vulnerabilities
Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
CVSS Score
6.1
EPSS Score
0.003
Published
2019-08-20
Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.
CVSS Score
6.8
EPSS Score
0.003
Published
2015-02-19
Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.
CVSS Score
4.3
EPSS Score
0.003
Published
2014-09-12