← All advisories

Medium severity4.8NVD Advisory· Published Dec 19, 2018· Updated Jun 17, 2026

CVE-2018-19506

CVE-2018-19506

Description

Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI.

Affected products

2

Zurmo/Zurmo CRM2 versions
cpe:2.3:a:zurmo:zurmo:3.2.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:zurmo:zurmo:3.2.4:*:*:*:*:*:*:*
- (no CPE)range: =3.2.4

Patches

Vulnerability mechanics

References

1

github.com/security-breachlock/CVE-2018-19506/blob/master/Zurmo_PS.pdfnvdExploitThird Party Advisory

News mentions

0

No linked articles in our index yet.