This vulnerability in Vtiger CRM 8.4.0's Dashboard module involves improper sanitization of the tabid parameter in the DashBoardTab view (getTabContents action). An attacker can inject arbitrary HTML code that will be executed in the context of the victim's browser when viewing the dashboard. The CVSS 3.1 base score is 6.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity. No patch or official remediation level has been published yet, and no known exploits have been reported.

Successful exploitation allows an attacker to inject arbitrary HTML into the dashboard interface, which can lead to partial disclosure or manipulation of information displayed to the user. The impact is limited to confidentiality and integrity with no direct effect on system availability. Since the injected content is rendered in the victim's browser, it could potentially be used for phishing or UI manipulation but does not escalate privileges or cause denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input in the Dashboard module. Consider restricting access to the affected functionality or applying web application firewall rules to detect and block suspicious input patterns targeting the tabid parameter.