What is the CVSS score of CVE-2025-60378?

CVE-2025-60378 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 1.1%.

Which versions of RISE CRM are affected by CVE-2025-60378?

RISE Ultimate Project Manager & CRM contains a stored script injection vulnerability (CVE-2025-60378, CVSS 8.1) allowing authenticated low-privilege users to inject malicious code into invoices and…

Is there a public PoC exploit available for CVE-2025-60378?

Yes, a public proof-of-concept exploit is available for CVE-2025-60378. Prioritise patching immediately. EPSS: 1.1%.

How to fix or mitigate CVE-2025-60378?

Within 24 hours: Inventory all RISE CRM instances; restrict low-privilege user permissions to create/edit invoices and customer-facing messages; audit recent outbound invoices and messages for suspicious content. Within 7 days: Implement input validation and HTML entity encoding on invoice/message fields; require approval workflow for external distribution; configure email gateway filters for suspicious embedded objects. Within 30 days: Contact fairsketch for patch timeline; if no patch released, initiate migration planning to alternative CRM platform.

RISE CRM CVE-2025-60378

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-10 cve@mitre.org

XSS Rise Ultimate Project Manager

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

4.6 MEDIUM

Authenticated user injects stored HTML (PR:L); realized phishing impact requires a recipient to view delivered content (UI:R) and is indirect/limited, so C:L/I:L, A:N.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:48 vuln.today

DescriptionCVE.org

Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.

AnalysisAI

Stored HTML/script injection in RISE Ultimate Project Manager & CRM (vendor fairsketch) lets authenticated low-privilege users embed attacker-controlled markup into invoices and messages that later renders in outbound emails, generated PDFs, and the in-app messaging/chat modules delivered to clients and staff. Because injected content is stored server-side and redistributed-amplified by automated recurring invoices-it functions as a persistent phishing and credential-harvesting vector rather than a memory-corruption bug. Publicly available exploit code exists (GitHub PoC), but there is no public exploit identified as actively used in the wild, and the EPSS probability is modest at 1.06% (61st percentile).

Technical ContextAI

The affected product is fairsketch's RISE, a PHP/CodeIgniter-based commercial project management and CRM suite (CPE cpe:2.3:a:fairsketch:rise_ultimate_project_manager). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied invoice and message fields are stored without sanitization or output encoding and then interpolated into multiple rendering contexts. The notable characteristic here is multi-sink output: the same tainted data is emitted into HTML emails, server-side PDF generation, and the web chat/messaging UI, so a single injection propagates across several trust boundaries and audiences.

RemediationAI

No vendor-released patch or fixed version is identified at time of analysis, and no vendor advisory URL is provided, so track fairsketch/CodeCanyon release notes for a corrected build and apply it once published. As specific compensating controls: enforce strict server-side sanitization/output encoding on invoice and message fields (allowlist plain text or a minimal safe-HTML subset), which may remove legitimate formatting some users rely on; disable or restrict the automated recurring-invoice and bulk-messaging features that fan out injected content to many recipients, at the cost of manual invoice workflows; and place a WAF or template-level HTML filter in front of the email/PDF generation pipeline, accepting that PDF rendering of rich content may break. Restrict account creation and invoice/message authoring to trusted staff to raise the bar on the required authenticated foothold. Reference for exploitation details: https://github.com/ajansha/CVE-2025-60378.