CVE-2008-3398: Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arb...

Security readout for executives and security teams

XRMS CRM 1.99.2 reportedly lets an attacker place malicious script or HTML into pages through a msg parameter. If users visit affected pages, the script could run in their browser. The public record is old and sparse, so urgency depends on whether any XRMS 1.99.2 instance is still reachable. Exposure is most likely limited to organizations still running XRMS CRM 1.99.2, especially internet-facing or broadly accessible deployments. The source bundle does not identify other affected versions or products. Treat as a targeted legacy-application risk. Prioritize quickly if XRMS is internet-facing or used by privileged staff; otherwise handle through legacy system remediation and retirement planning. Mitigation focus: Inventory environments for XRMS CRM 1.99.2 installations.; Check XRMS project or vendor guidance for fixed versions or patches.; Restrict access to any legacy XRMS instance until remediated..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.