TI-2022-06460 CVE-2022-22113 · GHSA-rjr7-pjq2-v9j9
DayByDay CRM - Insufficient Session Expiration after Password Change
Priority MEDIUM 40
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration.
Bottelet
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Bottelet records in CISA KEVNo Bottelet vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
14 records
TI-2022-06458 CVE-2022-22111 · GHSA-w6rp-4vj7-v2m8
DayByDay CRM - Missing Authorization when Changing Password
Priority MEDIUM 40
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization.
TI-2022-06457 CVE-2022-22110 · GHSA-96v6-hrwg-p378
DayByDay CRM - Weak Password Requirements in Update User
Priority LOW 35
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality.
TI-2022-06459 CVE-2022-22112 · GHSA-3xgw-mp56-cmcq
DayByDay CRM - Application-Wide Client-Side Template Injection (CSTI)
Priority LOW 25
In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI).
TI-2022-06456 CVE-2022-22109 · GHSA-jr37-66pj-36v7
DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title
Priority LOW 25
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks.
TI-2020-18167 CVE-2020-35707 · GHSA-hjwx-j74m-7j88
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
Priority LOW 25
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
TI-2020-18166 CVE-2020-35706 · GHSA-9hp5-8ggx-fcqr
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
Priority LOW 25
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
TI-2020-18165 CVE-2020-35705 · GHSA-9cr8-cgwr-97w6
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
Priority LOW 25
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
TI-2020-18164 CVE-2020-35704 · GHSA-6mvg-7752-5v6p
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
Priority LOW 25
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
TI-2026-09019 CVE-2026-10283 · GHSA-p22j-x82x-qp9f
Bottelet DaybydayCRM Setting missing authentication
Priority LOW 24
A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1.
TI-2026-80077 CVE-2026-116008 · GHSA-cx4x-jmw3-mhpf
Missing authorization in DaybydayCRM lets any user reassign projects
Priority LOW 23
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission…
TI-2026-09018 CVE-2026-10282 · GHSA-9wcr-pjwm-2cv7
Bottelet DaybydayCRM DocumentsController.php view improper authorization
Priority LOW 23
A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1.
TI-2022-06455 CVE-2022-22108 · GHSA-frxp-xxx8-hrg6
DayByDay CRM - Missing Authorization when Viewing Absences
Priority LOW 21
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.
TI-2022-06454 CVE-2022-22107 · GHSA-44gv-fgcj-w546
DayByDay CRM - Missing Authorization when Viewing Appointments
Priority LOW 21
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.