CVE-2018-9283

An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters in the contact creation and modification page. The payload is stored within the application database and allows the execution of JavaScript code each time a client visit an infected page.

• CWE-79

• https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/Exploit, Third Party Advisory
• https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/Exploit, Third Party Advisory

Published

Sep 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9275In check_user_token in util.c in the Yubico PAM module (aka …
• CVE-2018-9276An issue was discovered in PRTG Network Monitor before 18.2.…7.2
• CVE-2018-9279An issue was discovered on Eaton UPS 9PX 8000 SP devices. Th…
• CVE-2018-9280An issue was discovered on Eaton UPS 9PX 8000 SP devices. Th…
• CVE-2018-9281An issue was discovered on Eaton UPS 9PX 8000 SP devices. Th…
• CVE-2018-9282An XSS issue was discovered in Subsonic Media Server 6.1.1. …
• CVE-2018-9284authentication.cgi on D-Link DIR-868L devices with Singapore…9.8
• CVE-2018-9285Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT…
• CVE-2018-9302SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php…
• CVE-2018-9303In Exiv2 0.26, an assertion failure in BigTiffImage::readDat…
• CVE-2018-9304In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in…
• CVE-2018-9305In Exiv2 0.26, an out-of-bounds read in IptcData::printStruc…