{"id":"CVE-2019-10226","aliases":["EUVD-2022-3978","GHSA-gmg5-r3c4-3fm9"],"status":"disputed","title":"Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability","description":"HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04702,"percentile":0.91874,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2019-06-10T00:00:00Z","modified":"2026-09-10T03:49:22Z","exploits":[{"source":"exploitdb","id":"EDB-46617","title":"Fat Free CRM 0.19.0 - HTML Injection","type":"webapps","platform":"ruby","date":"2019-03-28","url":"https://www.exploit-db.com/exploits/46617"}],"products":[{"vendor":"fatfreecrm","product":"fat_free_crm"}],"references":[{"url":"http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html","tags":["x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.exploit-db.com/exploits/46617/","tags":["exploit","x_transferred"]},{"url":"https://github.com/fatfreecrm/fat_free_crm/issues/1235","tags":["x_transferred","web"]},{"url":"https://github.com/fatfreecrm/fat_free_crm/blob/master/app/views/comments/_comment.html.haml#L2","tags":["x_transferred","web"]},{"url":"https://apidock.com/rails/ActionView/Helpers/TextHelper/simple_format","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10226","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fat_free_crm/CVE-2019-10226.yml","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/3599","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/46617","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gmg5-r3c4-3fm9"},{"url":"https://github.com/fatfreecrm/fat_free_crm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-10226","description":"HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.","status":"disputed","published":"2019-06-10T00:00:00Z","modified":"2024-08-04T22:17:18.976Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2022-3978","description":"HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.","status":"published","published":"2019-06-10T00:00:00Z","modified":"2024-08-04T22:17:18Z","updated_at":"2026-11-03T02:40:53.61807Z"}],"ghsa":[{"id":"GHSA-gmg5-r3c4-3fm9","title":"Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability","description":"## Withdrawn\nThis advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references.\n\n[According to maintainers of Fat Free CRM](https://github.com/github/advisory-database/pull/3599), the CRM comment feature allows certain HTML markup, but santizes the output when rendered to page. This allows safe tags (such as `\u003ch1\u003e` which the author tested and reported as a vulnerability) but correctly disallows `\u003cscript\u003e` tags and other dangerous entities.\n\n## Original Description\nHTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI.","status":"withdrawn","published":"2022-05-24T16:47:42Z","modified":"2024-02-23T18:00:57Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2019-10226","description":"HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.","status":"disputed","published":"2019-06-10T23:29:02.467Z","modified":"2026-06-17T02:10:32.113Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"GHSA-gmg5-r3c4-3fm9","title":"Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability","description":"## Withdrawn\nThis advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references.\n\n[According to maintainers of Fat Free CRM](https://github.com/github/advisory-database/pull/3599), the CRM comment feature allows certain HTML markup, but santizes the output when rendered to page. This allows safe tags (such as `\u003ch1\u003e` which the author tested and reported as a vulnerability) but correctly disallows `\u003cscript\u003e` tags and other dangerous entities.\n\n## Original Description\nHTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI.","status":"withdrawn","published":"2022-05-24T16:47:42Z","modified":"2026-09-10T03:49:22.809345035Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:47.822182Z"}]}}