CVE-2022-22110: Daybydaycrm Daybyday CRM

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.

Affected products

• Daybydaycrm Daybyday CRM: from 1.1.0, up to and including 2.2.0

Published 2022-01-05. Last modified 2026-06-17.