CVE-2022-38335

Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.87% chance of exploitation in the next 30 days, 58th percentile

Published

2022-09-27

Updated

2025-05-21

Proof-of-concept exploits (1)

• sbaresearch/advisories/tree/public/2022/SBA-ADV-20220328-01_Vtiger_CRM_Stored_Cross-Site_…29★ · 2026-07-30

Security advisories

• https://code.vtiger.com/vtiger/vtigercrm
• https://www.vtiger.com

References

• CVE Record
• NVD entry

Related

• CVE-2015-5243
• CVE-2015-8299
• CVE-2018-13982
• CVE-2018-17532
• CVE-2018-17533
• CVE-2018-17534