0Xashfaq

**Name of the Vulnerable Software and Affected Versions** HelpDeskZ version 2.0.2 **Description** A cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Name` text field of Custom Fields message box. This issue potentially allows for remote attacks. **Recommendations** For HelpDeskZ version 2.0.2, patch immediately and validate inputs to prevent exploitation. Assess exposure, monitor for exploit attempts, and have an incident response plan ready. As a temporary workaround, consider restricting access to the Custom Fields message box until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Perfex CRM version 1.1.0 **Description** A stored cross-site scripting (XSS) issue in the Discussion section allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Content` parameter. This enables attackers to potentially manipulate the web application's behavior or steal user data. **Recommendations** For Perfex CRM version 1.1.0, as a temporary workaround, consider restricting access to the Discussion section until a patch is available. Avoid using the `Content` parameter in the affected Discussion section until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.