---
id: 4216
title: "[CVE-2018-9283] CremeCRM 1.6.12 - Multiple Vulnerabilities"
cve: CVE-2018-9283
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/cremecrm-1-6-12-advisory"
published_at: "2018-08-30T00:00:00Z"
tags: ["vulnerability", "stored-xss", "cremecrm", "link-manipulation", "cve-2018-9283", "crm"]
phying_url: "https://phying.com/item/4216"
lang: en
---

# [CVE-2018-9283] CremeCRM 1.6.12 - Multiple Vulnerabilities

## Summary

CremeCRM 1.6.12 has 29 stored XSS instances across contact, salesman and invoice pages plus a reflected link manipulation issue; upgrade to version 1.8.0 to remediate.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2018-9283
- **Published:** 2018-08-30T00:00:00Z
- **Original:** https://bishopfox.com/blog/cremecrm-1-6-12-advisory
- **Phying News:** https://phying.com/item/4216