ChangeWeDer CRM up to commit c07bd4c97141521af6475034bc58523beed51bbd contains a cross-site scripting vulnerability in the Save Endpoint component, specifically in the JavaScript file customer.serve.js. The vulnerability is caused by improper sanitization or validation of the customerName argument, enabling remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed, and exploit code is available. Due to the project's rolling release approach, no explicit version numbers for affected or patched releases are provided. The project has not yet responded to the issue report.

The vulnerability allows remote attackers to perform cross-site scripting attacks by manipulating the customerName parameter. This can lead to limited impact such as injection of malicious scripts in the context of the affected web application, potentially affecting user interactions. The CVSS score of 3.5 reflects a low severity impact with no confidentiality or availability impact, and only limited integrity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded to the issue report and no official fix is available, users should monitor for updates from the vendor. Until a fix is provided, consider applying input validation or sanitization controls on the customerName parameter at the application or web server level to mitigate exploitation.