$ cve CVE-2005-3818 JSON

CVE-2005-3818 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 5.1% (pctl 92)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) various input fields, including the contact, lead, and first or last name fields, (2) the record parameter in a DetailView action in the Leads module for index.php, (3) the $_SERVER['PHP_SELF'] variable, which is used in multiple locations such as index.php, and (4) aggregated RSS feeds in the RSS aggregation module.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	5.08% — more likely to be exploited than 92% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-11-26
Last modified	2026-06-16

Affected (1)

Vendor	Product
vtiger	vtiger crm

Public exploits

Source	Title	Date
exploit-db	vTiger CRM 4.2 Leads Module - 'record' Cross-Site Scripting	2005-11-24
exploit-db	vTiger CRM 4.2 RSS Aggregation Module - Feed Cross-Site Scripting	2005-11-24

References

→ the Explorer · watch your stack · NVD