X2crm

Vendor:

First CVE: Sep 30, 2013 · Active for 12 years

13
Total CVEs
More Total CVEs than 91% of tracked products
1.9
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
6.1
Avg CVSS
Higher Avg CVSS than 21% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact X2crm over time

Volume of CVEsAvg CVSS Base Score
First CVE
Sep 30, 2013
12 years ago
Most Recent CVE
Oct 14, 2024
649 days ago

CVE Severity & Scoring

X2crm13 CVEs
All CVEs352,708 CVEs
MediumHigh
Attack Vector
Local0 (0.0%)
Network8 (61.5%)
Unknown5 (38.5%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (61.5%)
High0 (0.0%)
Unknown5 (38.5%)
User Interaction
None1 (7.7%)
Unknown5 (38.5%)
Required7 (53.8%)
Privileges Required
Low5 (38.5%)
High1 (7.7%)
None2 (15.4%)
Unknown5 (38.5%)

Top CVEs

Signals from CVEs in this product scope (13 CVEs).

13 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2015-5074HIGH
Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated u
Sep 29, 20157.539NOYES
CVE-2013-5692HIGH
Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the fil
Sep 30, 20138.533NOYES
CVE-2022-48178MEDIUM
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update
Apr 15, 20235.429NOYES
CVE-2022-48177MEDIUM
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model p
Apr 15, 20235.429NOYES
CVE-2014-2664HIGH
Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote
Oct 17, 20178.827NONO
CVE-2015-5075MEDIUM
Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an admi
Sep 29, 20156.827NOYES
CVE-2024-48120MEDIUM
X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating
Oct 14, 20245.426NOYES
CVE-2013-5693MEDIUM
Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/edit
Sep 30, 20134.322NOYES
CVE-2021-33853MEDIUM
A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the att
Mar 16, 20225.421NONO
CVE-2020-21087MEDIUM
Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of
Apr 14, 20216.121NONO
View all 13 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (13 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
7 CVEs
53.8% of CVEs· 93rd percentile

Social Chatter

Signals from CVEs in this product scope (13 CVEs).

Media Mentions

Signals from CVEs in this product scope (13 CVEs).

Top CNAs Publishing CVEs For X2crm

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
8.515.40.6%01
8.015.40.6%00
7.116.10.9%00
6.925.41.8%02
6.625.41.8%02
3.426.44.5%02
3.3.226.44.5%02
3.3.126.44.5%02
3.326.44.5%02
3.226.44.5%02
3.1.226.44.5%02
3.1.126.44.5%02
3.126.44.5%02
3.0.226.44.5%02
3.0.126.44.5%02
3.026.44.5%02
2.9.126.44.5%02
2.926.44.5%02
2.8.126.44.5%02
2.826.44.5%02