CVE-2019-6036

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-27 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected products

Thinkingreed Inc. F-RevoCRM: from 6.0 before 6.5; 6.5, 6.5-patch2, 6.5-patch4, 6.5-patch5, 6.5-patch6 — fixed in 6.5

How to fix

Upgrade to a fixed version: Thinkingreed Inc. F-RevoCRM 6.5. Check the vendor advisory for mitigations.

References

http://jvn.jp/en/jp/JVN97325754/index.html
https://f-revocrm.jp/2019/12/9393
http://jvn.jp/en/jp/JVN97325754/index.html
https://f-revocrm.jp/2019/12/9393

Get alerted when CVE-2019-6036 or the next vulnerability affects your stack