{"id":"CVE-2022-48178","aliases":["EUVD-2022-50889","GHSA-pwjp-74x6-hcx5"],"status":"published","title":"X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting ...","description":"X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01831,"percentile":0.79029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2023-04-15T00:00:00Z","modified":"2026-10-28T02:30:28Z","exploits":[{"source":"exploitdb","id":"EDB-51345","title":"X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)","type":"webapps","platform":"php","date":"2023-04-08","url":"https://www.exploit-db.com/exploits/51345"}],"products":[{"vendor":"x2engine","product":"x2crm"}],"references":[{"url":"https://sourceforge.net/projects/x2engine/","tags":["x_transferred","Product","web"]},{"url":"http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48178","tags":["advisory"]},{"url":"https://sourceforge.net/projects/x2engine"},{"url":"https://github.com/advisories/GHSA-pwjp-74x6-hcx5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48178.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-48178","description":"X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.","status":"published","published":"2023-04-15T00:00:00Z","modified":"2025-02-06T15:49:15.652Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2022-50889","description":"X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.","status":"published","published":"2023-04-15T00:00:00Z","modified":"2025-02-06T15:49:15Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:03.312509Z"}],"ghsa":[{"id":"GHSA-pwjp-74x6-hcx5","title":"X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting ...","description":"X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.","status":"published","published":"2023-04-15T03:30:14Z","modified":"2024-04-04T03:30:14Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:15.423381Z"}],"nvd":[{"id":"CVE-2022-48178","description":"X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.","status":"published","published":"2023-04-15T01:15:06.92Z","modified":"2026-06-17T05:14:43.653Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:37.42466Z"}],"osv":[{"id":"CVE-2022-48178","description":"X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.","status":"published","published":"2023-04-15T00:00:00Z","modified":"2026-10-28T02:30:28.190260451Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:27.776402Z"}]}}