Priority LOW 23
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00196 · Published 2026-10-24 · No fix listed CWE-862
Priority LOW 24
A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00295 · Published 2026-06-01 · No fix listed CWE-287
Priority LOW 23
A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00227 · Published 2026-06-01 · No fix listed CWE-266
Priority MEDIUM 40
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01058 · Published 2022-01-13 · No fix listed CWE-613
Priority LOW 25
In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00636 · Published 2022-01-13 · No fix listed CWE-79
Priority MEDIUM 40
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01029 · Published 2022-01-05 · Fixed in 2.2.1 CWE-862
Priority LOW 35
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01159 · Published 2022-01-05 · Fixed in 2.2.1 CWE-521
Priority LOW 25
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00549 · Published 2022-01-05 · Fixed in 2.2.1 CWE-79
Priority LOW 21
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00702 · Published 2022-01-05 · Fixed in 2.2.1 CWE-862
Priority LOW 21
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00702 · Published 2022-01-05 · Fixed in 2.2.1 CWE-862
Priority LOW 25
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00602 · Published 2020-12-25 · No fix listed CWE-79
Priority LOW 25
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00602 · Published 2020-12-25 · No fix listed CWE-79
Priority LOW 25
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00602 · Published 2020-12-25 · No fix listed CWE-79
Priority LOW 25
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00602 · Published 2020-12-25 · No fix listed CWE-79
THREATIST.IORead the docs