CVE-2020-21087

6.1 mediumEPSS 1.4%

Medium (6.1) in x2engine x2crm. EPSS 1.4% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-04-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

x2engine:x2crm

References

https://github.com/X2Engine/X2CRM/issues/162
https://github.com/X2Engine/X2CRM/issues/162

Check your stack JSON