YetiForce CRM vulnerable to stored Cross-site Scripting

MEDIUM 5.4CVE-2022-3002 · GHSA-v9fj-h8g6-4w9q · Published 06/10/2022 · updated 17/06/2026

In short

CVE-2022-3002 is a MEDIUM (CVSS 5.4) vulnerability affecting yetiforce/yetiforce-crm, yetiforce customer relationship management (yetiforce).
Chance of exploitation in the next 30 days (EPSS): 0.70%, higher than 53.1% of all vulnerabilities.
Fix: update to 6.4.0 or later.

Package	Affected versions	Patched versions
yetiforce/yetiforce-crm Packagist	`≤ 6.4.0`	No fix yet
yetiforce customer relationship management yetiforce	`< 6.4.0`	`6.4.0`

YetiForce CRM version 6.4.0 and prior is vulnerable to stored cross-site scripting. A patch is available on the developer branch.

NVD description

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≤ 6.4.0

No fix yet

< 6.4.0

6.4.0

More vulnerabilities in yetiforce/yetiforce-crm

See all →