CVE-2013-5693: Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arb...

Security readout for executives and security teams

CVE-2013-5693 is a cross-site scripting issue in X2Engine X2CRM before version 3.5. An attacker could inject script or HTML through the model parameter on an administrative editor page, potentially affecting users who view the crafted content in the application. Organizations running X2Engine X2CRM versions earlier than 3.5 may be exposed, especially if the administrative editor route is reachable by untrusted users or external networks. The bundle does not define affected CPEs or authentication requirements. Treat this as a targeted remediation item for any legacy X2CRM deployment. Business urgency rises if the CRM is internet-facing or used by privileged staff, because browser-based compromise can support session theft, phishing, or unauthorized actions. Mitigation focus: Upgrade X2Engine X2CRM to version 3.5 or later.; Check current vendor guidance for any additional supported fixes.; Restrict access to X2CRM administrative routes where feasible..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.