| Package | Affected versions | Patched versions |
|---|---|---|
| espocrm | < 5.6.9 | 5.6.9 |
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus helping him steal victims' cookies (hence compromising their accounts).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free