A defect in Vtiger CRM 8.4.0’s MailManager module allows an attacker to supply a double URL‑encoded value for the _folder parameter, which is then reflected back into the page and executed as JavaScript in the browser of an authenticated user. This vulnerability can be exploited to run arbitrary scripts in the context of the authenticated session, potentially enabling theft of session cookies, impersonation, or delivery of malicious content to colleagues. The scope is limited to users who have valid login credentials and access to the MailManager feature.

The vulnerability affects the Vtiger CRM product, specifically version 8.4.0. No other versions or vendors are currently listed as impacted.

The CVSS score of 5.4 indicates moderate severity, while an EPSS score of less than 1% suggests low likelihood of exploitation. The issue is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated session and access to the MailManager module; an attacker must either compromise a user account or lure a user to supply the malicious parameter. Given these constraints, the overall risk is moderate but could be significant if attackers gain user credentials.