Cross-Site Scripting Vulnerability in F-RevoCRM by F-Revo
CVE-2026-71368

5.1MEDIUM

Key Information:

Vendor

Thinkingreed Inc.

Status
F-revocrm
Vendor
CVE Published:
20 August 2026

What is CVE-2026-71368?

F-RevoCRM has a flaw that allows for cross-site scripting attacks. A malicious user can exploit this vulnerability by delivering a specially crafted payload when a logged-in user accesses a compromised page, leading to unintended operations within the application. This poses a significant risk, as attackers may gain access to sensitive user data or perform actions on behalf of other users.

Affected Version(s)

F-RevoCRM 7.3.0 through 8.0.3

References

https://f-revocrm.jp/2026/08/47374/
https://jvn.jp/en/jp/JVN58692577/

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.