EUVD-2026-49393
GHSA-j59c-vr46-rhjx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated client required (PR:L), user interaction (UI:R), scope changed (S:C), low impacts.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Manage Clients or Manage Client Projects pages where client names are rendered unsanitized.
AnalysisAI
Stored cross-site scripting in Ekushey Project Manager CRM through version 5.0 allows authenticated client users to inject arbitrary HTML and JavaScript via the client Name field on the Edit Profile page, which is not sanitized. When staff or administrators view the Manage Clients or Manage Client Projects pages, the malicious scripts execute in their browser sessions. A proof-of-concept exploit is publicly available, though no active exploitation has been confirmed in CISA KEV.
Technical ContextAI
The vulnerability is a stored cross-site scripting (CWE-79) affecting the Ekushey Project Manager CRM, a PHP-based customer relationship management application sold on CodeCanyon. The flaw exists in the client Name field on the Edit Profile page, where user-supplied input is not sanitized before being stored and later rendered on administrative pages. When an administrator visits the Manage Clients or Manage Client Projects pages, the stored payload executes in the context of their browser, potentially leading to session hijacking, data theft, or further attacks. The CPE for the product is not provided, but the affected versions include all releases up to and including v5.0.
RemediationAI
No official patch has been released by the vendor as of the time of analysis. The most effective immediate mitigation is to implement input validation and output encoding for the client Name field, either through application-level fixes or a web application firewall (WAF) rule that encodes HTML tags in that field. Additionally, administrators should restrict the ability of client users to edit their own client Name field if business rules allow, or temporarily disable the Manage Clients pages until a fix is applied. These workarounds may impact client self-service functionality and administrative workflows, respectively.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today