CVE-2024-44779
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability was found in the viewname parameter on the index page of vTiger CRM 7.4.0. It allows an attacker to execute arbitrary JavaScript code in the victim's browser by injecting a crafted payload.
Risk Assessment
An attacker can hijack user sessions, steal sensitive data, or perform other malicious actions in the victim's browser context, threatening data confidentiality and integrity within the organization.
Recommendation
Immediately upgrade vTiger CRM to the latest version that includes a fix for this vulnerability. Until then, validate and sanitize the viewname parameter server-side.
Other vulnerabilities in vTiger CRM
See all- CVE-2016-1713High
In Vtiger CRM 6.4.0, there is an unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class that allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension.
- CVE-2024-44778Critical
A reflected cross-site scripting (XSS) vulnerability exists in the 'parent' parameter of the index page in vTiger CRM 7.4.0. Attackers can execute arbitrary JavaScript code in the victim's browser by injecting a crafted payload.
- CVE-2024-44777Critical
A reflected XSS vulnerability was found in vTiger CRM 7.4.0 in the 'tag' parameter on the index page. An attacker can inject malicious JavaScript that executes in the victim's browser.
- CVE-2026-23698High
Vtiger CRM up to version 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature. An administrator can upload a crafted ZIP archive that extracts arbitrary PHP files into the modules/ directory under the web root without validating file types beyond manifest.xml.
- CVE-2026-23697High
Vtiger CRM before version 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file with arbitrary PHP code via the Documents module. The vulnerability is due to the omission of the .phar extension from the denylist in config.inc.php and a misconfigured .htaccess file that is silently ignored on Apache 2.4 deployments.
- CVE-2024-44776Medium
An Open Redirect vulnerability was found in vTiger CRM v7.4.0 in the 'page' parameter. An attacker can craft a URL to redirect users to a malicious site.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.