Ekushey CRM CVE-2025-40989

Exploitation requires the attacker to have a valid authenticated account on the Ekushey CRM instance (PR:L) with access to create project messages, and it requires a second authenticated user to view the attacker's stored message for the payload to fire (UI:P / victim interaction). The specific prerequisite is the ability to submit the 'message' parameter via POST to /ekushey/index.php/client/project_message/add/xxx, which lacks proper input validation/output encoding. Limiting factors that reduce real-world risk: authentication is mandatory (no anonymous exploitation), a victim must actively open the malicious message, and impact is confined to the victim's session context (cookie/session theft) with no direct server compromise.

This is a medium-severity stored XSS (CWE-79, CVSS 4.0 base 5.1) that should be treated as a low-priority, low-urgency issue rather than an emergency. Multiple independent signals agree on low real-world risk: EPSS is 0.03% (9th percentile), there is no CISA KEV listing, and no public proof-of-concept was identified - so this is 'no public exploit identified at time of analysis.' The CVSS 4.0 vector itself tempers the severity: it requires an authenticated attacker (PR:L), requires victim interaction (UI:P), and yields no confidentiality/integrity/availability impact on the vulnerable system (VC:N/VI:N/VA:N), with only limited subsequent-system impact (SC:L/SI:L) consistent with session-cookie theft via another user's browser. Signals are mutually consistent - there is no conflict between a low EPSS and the absence of KEV/POC, and the moderate CVSS reflects genuine but bounded impact. The main caveat is sourcing: the only substantive reference is a bundled INCIBE-CERT advisory covering multiple Creativeitem products, so per-vulnerability patch confirmation is not independently verifiable from the provided data.

An authenticated low-privilege user of Ekushey CRM submits a project message containing a malicious script payload via the 'message' POST parameter at /ekushey/index.php/client/project_message/add/xxx. When another authenticated user (e.g., a project collaborator or administrator) views that message, the stored script executes in their browser and exfiltrates their session cookie. No public exploit code was identified, but the injection point and HTTP method are documented, making manual reproduction straightforward.