Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers inject malicious scripts through unvalidated input parameters. Attackers can submit crafted payloads in manual insertion points execute arbitrary JavaScript code victim's browser context.