{"id":"CVE-2021-27288","details":"Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the \"Comment\" field in \"/profile/activity\" page.","modified":"2026-07-09T01:06:30.170813Z","published":"2021-04-14T14:15:13.710Z","references":[{"type":"EVIDENCE","url":"https://github.com/X2Engine/X2CRM/issues/183"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/x2engine/x2crm","events":[{"introduced":"b60fb5c4ae969f59e6d4b9efa2ae72394ed45e60"},{"last_affected":"b60fb5c4ae969f59e6d4b9efa2ae72394ed45e60"}],"database_specific":{"cpe":"cpe:2.3:a:x2engine:x2crm:7.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.1"},{"last_affected":"7.1"}],"source":"CPE_STRING"}}],"versions":["7.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-27288.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}