Multiple Cross Site Scripting in X2CRM 7.1

[Hades484]

Hi,

I have found the multiple stored XSS in the X2crm version 7.1. I like to report them and get the CVE.

Location: http://localhost/x2crm/x2engine/index.php/contacts/create
Parameter: Last Name
Payload inserted

Execution of the payload

Location: http://localhost/x2crm/x2engine/index.php//profile/activity
Parameter: comments
payload inserted

Execution of the payload