CVE-2022-22112: Daybydaycrm Daybyday

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.

Affected products

• Daybydaycrm Daybyday: from 1.1, up to and including 2.2.1

Published 2022-01-13. Last modified 2026-06-17.