Description

Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.

Remediation

References

CVE-2020-28956

Related Vulnerabilities

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-32464)

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-9015)

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33327)

WordPress Plugin Import any XML or CSV File to WordPress Arbitrary File Upload (3.6.7)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-23174)

Severity

Medium

Classification

CVE-2020-28956 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities