F Revocrm
Monthly
Cross-site scripting in F-RevoCRM versions 7.3.0 through 8.0.3 enables remote attackers to inject and execute malicious client-side scripts in the browser of an authenticated user who is lured to a crafted page. The CVSS S:C (scope changed) metric confirms the injected script operates beyond the application's trust boundary, enabling session hijacking, credential theft, or unauthorized CRM operations performed under the victim's identity. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed via JPCERT and documented under JVN#58692577.
F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting in F-RevoCRM versions 7.3.0 through 8.0.3 enables remote attackers to inject and execute malicious client-side scripts in the browser of an authenticated user who is lured to a crafted page. The CVSS S:C (scope changed) metric confirms the injected script operates beyond the application's trust boundary, enabling session hijacking, credential theft, or unauthorized CRM operations performed under the victim's identity. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed via JPCERT and documented under JVN#58692577.
F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.