medium5.4Public exploit code
CVE-2024-48120
X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- X2CRM 8.5 - Stored Cross-Site Scripting (XSS)2025-03-27 · webapps · php
Impact
X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating a list.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| X2engine | X2crm | Version 8.5 |