Description
In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bottelet | DaybydayCRM | 1.1 – < unspecified | unspecified |