EUVD-2025-32669Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web endpoint; low privileges likely needed to submit CRM jobs; victim interaction required; scope changes to browser; session cookie theft yields high confidentiality impact.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
Lifecycle Timeline
4DescriptionCVE.org
Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
AnalysisAI
Stored XSS in Energy CRM v2025 (by Status Tracker Ltd) enables session hijacking against authenticated users through unsanitized input accepted at the job creation endpoint. An attacker able to POST a crafted payload to /crm/create_job_submit.php via the JobCreatedBy parameter can persist malicious JavaScript in the CRM database; when an authenticated user subsequently views the affected job record, the script executes in their browser and can exfiltrate session cookies to the attacker. No public exploit code has been identified and no CISA KEV listing exists; EPSS is 0.03% (9th percentile), consistent with the niche deployment footprint of this energy-sector CRM.
Technical ContextAI
Energy CRM v2025 is a PHP-based customer relationship management platform for the energy sector, identified by CPE cpe:2.3:a:energycrm:energy_crm:2025:*:*:*:*:*:*:*. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the application accepts user-controlled data through the JobCreatedBy POST parameter at /crm/create_job_submit.php without adequate server-side sanitization or output encoding, and subsequently renders that data to other users without escaping HTML or JavaScript metacharacters. This classic stored (persistent) XSS pattern means the injected script is written to a backend store and fires for every user who loads the page containing the poisoned record, making it more impactful than reflected variants. The INCIBE advisory also references ViDay (all versions) as a separately affected product, suggesting Status Tracker Ltd has a systemic input validation gap across its product line.
RemediationAI
Upstream fix availability has not been independently confirmed from the provided data - no exact patched version number is cited in the INCIBE advisory reference. Organizations running Energy CRM v2025 should contact Status Tracker Ltd directly and monitor the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker for patch release information. As a compensating control, restrict access to /crm/create_job_submit.php via web application firewall (WAF) rules that block common XSS patterns in the JobCreatedBy POST parameter; note that WAF bypass is possible with obfuscated payloads, so this is not a substitute for a code-level fix. Additionally, enforce Content Security Policy (CSP) headers that disallow inline script execution, which will prevent cookie exfiltration even if the payload is stored. If the CRM is not required to be network-accessible, restrict it to internal network segments to reduce the attack surface consistent with the AV:A scoring. For ViDay deployments, apply the same WAF and network restriction controls and monitor the separate INCIBE advisory.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today