CVE-2024-44778

Critical · CVSS 9.6

vTiger CRM — Reflected Cross-Site Scripting (XSS)

CVSS: 9.6; nvd
EPSS: —
KEV: No
Class: other; CWE-79, CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

Search profile — drives PoC discovery

Symbols parentindexindex.phpparent parametercrafted payload

Keywords CVE-2024-44778vTiger CRMvTiger CRM 7.4.0reflected XSScross-site scriptingparent parameterindex pageXSS vTigervTiger XSS PoCvTiger 7.4.0 vulnerability

Versions: 7.4.0

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

fkie-cad/nvd-json-data-feeds needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

https://packetstormsecurity.com/files/180462/vTiger-CRM-7.4.0-Cross-Site-Scripting.html

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z