CVE-2021-4121

Description

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

How to fix CVE-2021-4121

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• Packagist/yetiforce/yetiforce-crm—no fix listed

Is CVE-2021-4121 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 6.3.0

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-4121
• PATCHgithub.com/yetiforcecompany/yetiforcecrm
• WEBgithub.com/yetiforcecompany/yetiforcecrm/commit/6b5967198e43b6fbb3b2715b49c6cd5b12ce08c3
• WEBhuntr.dev/bounties/6da878de-acdb-4b97-b9ff-9674c3f0881d