CVE-2022-22112

Published January 13th, 2022

View on NVD ↗

CVSS v3

5.4

MEDIUM

CVSS v2

3.5

LOW

Affected

PROJECT

Description

In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.

Bottelet/DaybydayCRM

DaybydayCRM an open-source CRM, to help you keep track of your daily workflow.

GitHub

2.32K