CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0

Medium · published April 13, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view (getTabContents action), allowing an attacker to inject arbitrary HTML content into the dashboard interface. The injected content is rendered in the victim's browser

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.2th percentile
Published
2026-04-13T00:00Z
EPSS history
Timeline
  • 13 APR 00:00Z
    A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0
    cvelistv5