CVE-2022-22112 MEDIUM

CVE-2022-22112: DayByDay CRM - Application-Wide Client-Side Template Injection (CSTI)

Vendor Bottelet

Product DaybydayCRM

Weakness CWE-79 · XSS

Published January 13, 2022

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.

Key dates

02Disclosure timeline

January 13, 2022 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-22112 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2022-22109 DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title CVE-2025-57986 WordPress WP Subtitle plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-11412 Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-40675 WordPress Landing Page Builder Plugin <= 1.5.1.2 is vulnerable to Cross Site Scripting (XSS) CVE-2024-52478 WordPress Jobify theme < 4.3.0 - Cross Site Scripting (XSS) vulnerability