X2engine develops a modestly represented customer relationship management platform, with disclosures centered on its X2CRM product and closely related offerings. The vulnerability profile reflects the web-application attack surface: the product recurs across cross-site scripting, cross-site request forgery, code injection, input validation, and path-traversal weaknesses that are typical of server-side CRM and data-handling applications, and these flaws tend to acquire public exploit code. Treat this vendor's advisory activity as a web-application security concern rather than a systemic threat; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by X2engine over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-5074HIGH Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated u | Sep 29, 2015 | 7.5 | 39 | NO | YES |
CVE-2013-5692HIGH Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the fil | Sep 30, 2013 | 8.5 | 33 | NO | YES |
CVE-2022-48178MEDIUM X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update | Apr 15, 2023 | 5.4 | 29 | NO | YES |
CVE-2022-48177MEDIUM X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model p | Apr 15, 2023 | 5.4 | 29 | NO | YES |
CVE-2014-2664HIGH Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote | Oct 17, 2017 | 8.8 | 27 | NO | NO |
CVE-2015-5075MEDIUM Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an admi | Sep 29, 2015 | 6.8 | 27 | NO | YES |
CVE-2024-48120MEDIUM X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating | Oct 14, 2024 | 5.4 | 26 | NO | YES |
CVE-2014-5297HIGH The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side R | Oct 10, 2014 | 7.5 | 24 | NO | NO |
CVE-2013-5693MEDIUM Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/edit | Sep 30, 2013 | 4.3 | 22 | NO | YES |
CVE-2021-33853MEDIUM A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the att | Mar 16, 2022 | 5.4 | 21 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by X2engine.
Media articles that mention a CVE ID that affects a product developed by X2engine — matched by CVE ID, not by vendor name.