CVE-2022-22109: DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-05 · updated 2026-06-17
Weakness: CWE-79

Description

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.

Affected products

Daybydaycrm Daybyday Crm: 2.2.0

References

https://github.com/Bottelet/DaybydayCRM/commit/002dc75f400cf307bd00b71a5a93f1e26e52cee2
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22109
https://github.com/Bottelet/DaybydayCRM/commit/002dc75f400cf307bd00b71a5a93f1e26e52cee2
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22109

Get alerted when CVE-2022-22109 or the next vulnerability affects your stack