Reflected XSS Vulnerability in Vtiger CRM by Vtiger
CVE-2025-70936

5.4MEDIUM

Key Information:

Vendor

Vtiger

Status
Vtiger CRM
Vendor
CVE Published:
13 April 2026

What is CVE-2025-70936?

Vtiger CRM 8.4.0 presents a reflected cross-site scripting vulnerability within the MailManager module due to inadequate processing of user-controlled input in the _folder parameter. This flaw enables an attacker to craft a double URL-encoded payload that can be executed within an authenticated user's session, potentially compromising sensitive information and security integrity.

References

https://www.vtiger.com/open-source-crm/
https://www.simonjuguna.com/cve-2025-70936-reflected-xss-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.