Description
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.
Published: 2023-04-15
Score: 5.4 Medium
EPSS: 2.5% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-50888 X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.
History

Fri, 30 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared X2engine
X2engine x2crm
CPEs cpe:2.3:a:x2crm:x2crm:6.6:*:*:*:*:*:*:*
cpe:2.3:a:x2crm:x2crm:6.9:*:*:*:*:*:*:*		 cpe:2.3:a:x2engine:x2crm:6.6:*:*:*:*:*:*:*
cpe:2.3:a:x2engine:x2crm:6.9:*:*:*:*:*:*:*
Vendors & Products X2crm
X2crm x2crm
X2engine
X2engine x2crm

Thu, 06 Feb 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

X2engine X2crm
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-02-06T15:51:33.777Z

Reserved: 2022-12-29T00:00:00.000Z

Link: CVE-2022-48177

cve-icon Vulnrichment

Updated: 2024-08-03T15:02:36.671Z

cve-icon NVD

Status : Modified

Published: 2023-04-15T01:15:06.867

Modified: 2026-01-30T16:42:00.253

Link: CVE-2022-48177

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses