VULNERABILITY INTELLIGENCE

CVE-2025-45755

CVSS score6.1 MEDIUM
EPSS probability0.31%
CISA KEVNot currently listed
Published2025-05-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped to the Service Name field. When the file is uploaded, the application improperly sanitizes user input, leading to persistent script execution.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references