Energy CRM
CVE-2025-40643
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Energy CRM as low-priv user
-
DeliveryPOST script payload via JobCreatedBy to create_job_submit.php
-
ExploitPayload stored unvalidated in job record
-
ExecutionVictim user opens affected record
-
PersistScript executes, steals session cookie
-
ImpactHijack victim's authenticated session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on Energy CRM v2025 with access to the job-creation function, so the attacker can POST to /crm/create_job_submit.php and inject into the JobCreatedBy parameter (PR:L). Exploitation further depends on a second authenticated user subsequently viewing the stored job record for the payload to fire (UI:P / passive interaction). These two factors - needing a CRM account and a victim who opens the poisoned record - are the principal limits; impact is restricted to the victim's browser session (no server-side confidentiality, integrity, or availability impact). |
| Impact | This is a medium-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) whose real-world priority is modest. The CVSS 4.0 vector shows network reach (AV:N) and low attack complexity (AC:L), but exploitation requires attacker authentication (PR:L) and passive victim interaction (UI:P), and impact is confined to the subsequent (victim browser) system with no impact on the vulnerable server itself (VC:N/VI:N/VA:N, SC:L/SI:L). EPSS is low at 0.21% (10th percentile), consistent with an obscure, low-footprint product and the authenticated/interaction prerequisites; there is no CISA KEV listing and no public exploit identified at time of analysis. All signals align downward: no active-exploitation or POC signal contradicts the low EPSS, so this reads as a genuine-but-low-priority issue rather than a high-CVSS/low-real-risk mismatch. Note the only reference is the INCIBE-CERT coordinated advisory; a dedicated vendor advisory and confirmed fixed version were not present in the provided data and should be verified with Status Tracker Ltd. |
| Exploit ScenarioDerived | An authenticated low-privilege user submits a POST to /crm/create_job_submit.php with a malicious script payload in the JobCreatedBy parameter, which is stored without proper validation. When another authenticated user later views the job record, the script executes in their browser and exfiltrates their session cookie, enabling session hijacking. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stored cross-site scripting in Energy CRM v2025 allows an authenticated attacker holding a valid CRM account to inject a malicious script into the JobCreatedBy parameter of a POST request to /crm/create_job_submit.php, which is then persisted and executed in the browser of any authenticated CRM user who opens the affected job record. The result is client-side compromise of the victim's browsing session, with the described objective being theft of cookie session details; the vendor's own CVSS 4.0 base is 5.1, and the independent assessment reaches a comparable medium-severity rating (CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that an attacker needs both a CRM account and a victim who views the poisoned record, with no server-side confidentiality, integrity, or availability impact. Exploitation status: no public exploit identified at time of analysis; EPSS is 0.21% (10th percentile), and the flaw is not listed in CISA KEV, so real-world prioritization is modest.
RemediationAI
No vendor-released patch was identified in the available intelligence, and the INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker) is the authoritative coordination reference to monitor for an updated Energy CRM build from Status Tracker Ltd; because this CVE was published with no fix version, the absence of data should not be read as confirmation that none exists, and the vendor should be contacted directly for a patched release. Until a fix is available, apply specific compensating controls rather than generic hardening: set session cookies with the HttpOnly, Secure, and SameSite=Lax (or Strict) attributes so that script injected into the CRM origin cannot read the session token - the primary trade-off is that JavaScript-based session handling in the application may break if it relies on reading cookies client-side; deploy a restrictive Content-Security-Policy (script-src 'self' or nonce-based, with no 'unsafe-inline') to block execution of injected inline script, accepting that tightly scoped policies frequently require tuning against legacy inline handlers in the CRM UI; enforce server-side output encoding of the JobCreatedBy value on render (context-aware HTML encoding) as the actual root-cause fix, which is safe and has no user-visible downside; and, as a containment measure, restrict access to /crm/create_job_submit.php to the smallest set of trusted roles that genuinely need job-creation rights, which reduces the pool of accounts able to plant stored payloads but may disrupt normal sales or operations staff workflows. Because exploitation is limited to the victim's browser session with no server-side C/I/A impact, these client-side and access-control mitigations address the realistic risk without requiring the endpoint to be taken offline.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting) in a PHP-based CRM application, Energy CRM v2025, identified by CPE cpe:2.3:a:energycrm:energy_crm:2025. The application accepts user-supplied content in the JobCreatedBy field of the job-creation workflow (/crm/create_job_submit.php) and stores that value without adequate sanitization or output encoding. Because the payload is persisted server-side and later rendered into the job record view, this is a classic stored (persistent) XSS rather than a reflected one: the malicious script executes in the security context of the Energy CRM origin each time a user loads the poisoned record, not just for the submitter. The impact class is limited to the browser session (scope change per CVSS 4.0 includes SC:L/SI:L), meaning script running in the CRM origin can read document content, perform actions as the victim within the application, and, where session cookies are not protected by the HttpOnly attribute, exfiltrate session identifiers. Successful defense-in-depth therefore depends less on network controls and more on output-context encoding of the JobCreatedBy value, strict Content Security Policy, and cookie hardening (HttpOnly, Secure, SameSite). The CVSS 4.0 vector supplied by the vendor/advisory includes PR:L, confirming the attacker must already be authenticated to the application, and UI:P, confirming a second user's passive interaction is required for the payload to fire.
Know when Energy Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Authenticated attacker injects the payload (PR:L) and a victim must view it (UI:R); stored XSS crosses into the victim's browser (S:C) with low confidentiality/integrity impact and no availability impact.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Energy Crm
View allStored XSS in Energy CRM v2025 (by Status Tracker Ltd) enables session hijacking against authenticated users through uns
Authenticated low-privileged users of Energy CRM v2025 can store XSS payloads through the invoice-creation workflow, whi
GitHub PoC
Exploit-DB