A failure to neutralize user‑supplied input in the tabid parameter of Vtiger CRM’s Dashboard module allows an attacker to inject arbitrary HTML content that is rendered directly in the victim’s browser. The injected code runs with the privileges of the user viewing the dashboard, enabling actions such as cookie theft, session hijacking, phishing, or defacement. The flaw is a classic cross‑site scripting vulnerability arising from improper output encoding.

Vtiger CRM (open‑source edition) version 8.4.0. The vulnerability is located in the DashBoardTab view during the getTabContents action and only this version is confirmed to be affected. No other versions are listed in the available data.

The CVSS score is 6.1, EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog. The low EPSS score suggests that exploitation is unlikely in the near term, although the flaw remains a medium‑severity XSS risk if an attacker manages to supply a malicious tabid parameter. The impact on confidentiality, integrity, and availability remains significant for authenticated users who can view the dashboard.