opencrx records

14 published records for vendor opencrx.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 21.4%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

14 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2023-46502No exploit	An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure Docuopencrx · opencrx · CWE-611 Pre-auth XXE	Critical9.8	—	0.9%	Oct 30, 2023
37Monitor	CVE-2020-7378Proof of concept	CRIXP OpenCRX Unverified Password Changeopencrx · opencrx · CWE-620 Pre-auth	Critical9.1	—	2.6%	Nov 24, 2020
24Monitor	CVE-2021-25959No exploit	OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionalityopencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Sep 29, 2021
24Monitor	CVE-2023-40812No exploit	OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.opencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Nov 18, 2023
24Monitor	CVE-2023-40810No exploit	OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.opencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Nov 18, 2023
24Monitor	CVE-2023-40813No exploit	OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.opencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Nov 18, 2023
24Monitor	CVE-2023-40809No exploit	OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.opencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Nov 18, 2023
24Monitor	CVE-2023-40815No exploit	OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.opencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Nov 18, 2023
24Monitor	CVE-2023-40816No exploit	OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.opencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Nov 18, 2023
24Monitor	CVE-2023-40817No exploit	OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.opencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Nov 18, 2023
24Monitor	CVE-2023-40814No exploit	OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.opencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Nov 18, 2023
24Monitor	CVE-2023-27151No exploit	openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) vopencrx · opencrx · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Feb 28, 2024
21Monitor	CVE-2022-40084No exploit	OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a passopencrx · opencrx · CWE-203 Pre-auth	Medium5.3	—	0.7%	Oct 20, 2022
21Monitor	CVE-2023-27150No exploit	openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage opencrx · opencrx · CWE-79 XSS	Medium5.4	—	0.3%	Dec 26, 2023

CVE-2023-46502
39Monitor
An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure Docu
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- XXE
opencrx · opencrxOct 30, 2023
CVE-2020-7378
37Monitor
CRIXP OpenCRX Unverified Password Change
CriticalCVSS 9.1Proof of conceptEPSS 2%
- Pre-auth
opencrx · opencrxNov 24, 2020
CVE-2021-25959
24Monitor
OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionality
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxSep 29, 2021
CVE-2023-40812
24Monitor
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxNov 18, 2023
CVE-2023-40810
24Monitor
OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxNov 18, 2023
CVE-2023-40813
24Monitor
OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxNov 18, 2023
CVE-2023-40809
24Monitor
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxNov 18, 2023
CVE-2023-40815
24Monitor
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxNov 18, 2023
CVE-2023-40816
24Monitor
OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxNov 18, 2023
CVE-2023-40817
24Monitor
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxNov 18, 2023
CVE-2023-40814
24Monitor
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxNov 18, 2023
CVE-2023-27151
24Monitor
openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) v
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
opencrx · opencrxFeb 28, 2024
CVE-2022-40084
21Monitor
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a pass
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
opencrx · opencrxOct 20, 2022
CVE-2023-27150
21Monitor
openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage
MediumCVSS 5.4No exploitEPSS 0%
- XSS
opencrx · opencrxDec 26, 2023