Description

Cross-site scripting (XSS) vulnerability in EspoCRM before 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the desc parameter in an errors action to install/index.php.

Remediation

References

CVE-2014-7987

Related Vulnerabilities

WordPress Plugin Contact Form 7 Security Bypass (3.7.1)

WordPress Plugin iThemes Exchange:Simple WP Ecommerce Remote Code Execution (1.14.0)

phpMyFAQ Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) Vulnerability (CVE-2023-1758)

Drupal Other Vulnerability (CVE-2007-0124)

DataTables Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36713)

Severity

Medium

Classification

CVE-2014-7987 CWE-707

Tags

Missing Update Known Vulnerabilities