CVE-2005-3818

no score yetEPSS 5.1%

vtiger vtiger crm: no CVSS score yet. EPSS 5.1% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) various input fields, including the contact, lead, and first or last name fields, (2) the record parameter in a DetailView action in the Leads module for index.php, (3) the $_SERVER['PHP_SELF'] variable, which is used in multiple locations such as index.php, and (4) aggregated RSS feeds in the RSS aggregation module.

EPSS: 5.1% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
Published: 2005-11-26
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

vtiger:vtiger_crm

References

http://secunia.com/advisories/17693
http://securitytracker.com/id?1015271
http://www.hardened-php.net/advisory_232005.105.html
http://www.osvdb.org/21227
http://www.osvdb.org/21228

Check your stack JSON