Search
Search Results (7 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116008 | 2 Bottelet, Daybydaycrm | 2 Daybydaycrm, Daybyday Crm | 2026-11-05 | 4.3 Medium |
| DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications. | ||||
| CVE-2022-22113 | 1 Daybydaycrm | 1 Daybyday | 2024-11-21 | 8.8 High |
| In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed. | ||||
| CVE-2022-22112 | 1 Daybydaycrm | 1 Daybyday | 2024-11-21 | 5.4 Medium |
| In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser. | ||||
| CVE-2020-35707 | 1 Daybydaycrm | 1 Daybyday | 2024-11-21 | 5.4 Medium |
| Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen. | ||||
| CVE-2020-35706 | 1 Daybydaycrm | 1 Daybyday | 2024-11-21 | 5.4 Medium |
| Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen. | ||||
| CVE-2020-35705 | 1 Daybydaycrm | 1 Daybyday | 2024-11-21 | 5.4 Medium |
| Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen. | ||||
| CVE-2020-35704 | 1 Daybydaycrm | 1 Daybyday | 2024-11-21 | 5.4 Medium |
| Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen. | ||||
Page 1 of 1.