CVE-2019-10226
Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.
- Record
CVE-2019-10226- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.
- Record
CVE-2019-10226- Updated
- 2026-11-02
EUVDEUVD-2022-3978 No score
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.
- Record
EUVD-2022-3978- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gmg5-r3c4-3fm9
Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability
Withdrawn
This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references.
According to maintainers of Fat Free CRM, the CRM comment feature allows certain HTML markup, but santizes the output when rendered to page. This allows safe tags (such as <h1> which the author tested and reported as a vulnerability) but correctly disallows <script> tags and other dangerous entities.
Original Description
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI.
- Record
GHSA-gmg5-r3c4-3fm9- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-gmg5-r3c4-3fm9
Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability
Withdrawn
This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references.
According to maintainers of Fat Free CRM, the CRM comment feature allows certain HTML markup, but santizes the output when rendered to page. This allows safe tags (such as <h1> which the author tested and reported as a vulnerability) but correctly disallows <script> tags and other dangerous entities.
Original Description
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI.
- Record
GHSA-gmg5-r3c4-3fm9- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Fat Free CRM 0.19.0 - HTML Injection | 2019-03-28 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10226 is a medium vulnerability (CVSS 5.4) in Fatfreecrm Fat Free Crm, published June 10, 2019. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.70%, the 91st percentile.
References
packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html
exploit-db.com/exploits/46617
github.com/fatfreecrm/fat_free_crm/issues/1235
apidock.com/rails/ActionView/Helpers/TextHelper/simple_format
nvd.nist.gov/vuln/detail/CVE-2019-10226