Ekushey Project Manager Crm
Monthly
Stored cross-site scripting in Ekushey Project Manager CRM allows a malicious or compromised administrator to inject arbitrary HTML and script into the application's login page, which then executes silently in the browser of every unauthenticated visitor who loads that page - including users about to submit their credentials. The vulnerability persists until the system name setting is corrected, and the payload runs within the CRM's own origin, co-located with the credential input fields. A public proof-of-concept exists on GitHub (LindHunt/CVE-2026-26211); no CISA KEV listing or vendor patch has been identified at time of analysis.
Stored cross-site scripting in Ekushey Project Manager CRM through version 5.0 allows authenticated client users to inject JavaScript via the Reply Ticket field, which executes when staff or administrators view the support ticket detail page. A public proof-of-concept is available, but no active exploitation has been reported. The flaw can expose privileged users to session theft or credential phishing.
Stored cross-site scripting in Ekushey CRM 5.0 (Creativeitem's Ekushey Project Manager CRM) lets an authenticated user who can reach the client project-file upload endpoint at /ekushey/index.php/client/project_file/upload/xxxx inject a crafted value into the 'description' POST parameter that is later rendered without encoding to other users. Because the payload is persisted server-side, a second authenticated victim who opens the poisoned project file - such as a manager or administrator - has attacker-controlled script run inside their browser session, enabling theft of session cookies or other in-session data. Exploitation requires a valid low-privileged login plus victim interaction (no KEV listing, no public exploit identified at time of analysis, EPSS 0.03% / 9th percentile), so the reporting and the independent re-assessment agree this is a medium-to-low priority issue rather than a mass-exploitation risk.
Stored cross-site scripting in Ekushey CRM 5.0 allows an authenticated user to plant persistent JavaScript in the 'title' and 'description' POST parameters of the project bug creation endpoint (/ekushey/index.php/client/project_bug/create/), which then executes in the browser of any other authenticated user who opens the affected bug record. The root cause is the absence of input validation and output encoding on those fields (CWE-79), rated CVSS 4.0 base 5.1, and exploitation requires both a valid low-privilege login and the victim interacting with the poisoned record, so impact is confined to session/cookie theft in the victim's browser rather than server compromise. No public exploit code has been identified at time of analysis, and EPSS is 0.03% (9th percentile), consistent with a low-priority, interaction-dependent issue.
Stored cross-site scripting in Ekushey Project Manager CRM 5.0 lets an authenticated user inject a malicious payload into the 'message' parameter submitted via POST to /ekushey/index.php/client/project_message/add/xxx, which later executes in the browser of any other authenticated user who opens the affected project message, potentially exposing that user's session cookie. Exploitation requires a valid authenticated account plus a second authenticated victim who actively views the stored message, so impact is confined to the victim's session context rather than the server. No public exploit code has been identified at time of analysis, EPSS is negligible at 0.03% (9th percentile), and the issue is not listed in CISA KEV, making this a low-urgency, medium-severity finding.
Stored cross-site scripting in Ekushey Project Manager CRM allows a malicious or compromised administrator to inject arbitrary HTML and script into the application's login page, which then executes silently in the browser of every unauthenticated visitor who loads that page - including users about to submit their credentials. The vulnerability persists until the system name setting is corrected, and the payload runs within the CRM's own origin, co-located with the credential input fields. A public proof-of-concept exists on GitHub (LindHunt/CVE-2026-26211); no CISA KEV listing or vendor patch has been identified at time of analysis.
Stored cross-site scripting in Ekushey Project Manager CRM through version 5.0 allows authenticated client users to inject JavaScript via the Reply Ticket field, which executes when staff or administrators view the support ticket detail page. A public proof-of-concept is available, but no active exploitation has been reported. The flaw can expose privileged users to session theft or credential phishing.
Stored cross-site scripting in Ekushey CRM 5.0 (Creativeitem's Ekushey Project Manager CRM) lets an authenticated user who can reach the client project-file upload endpoint at /ekushey/index.php/client/project_file/upload/xxxx inject a crafted value into the 'description' POST parameter that is later rendered without encoding to other users. Because the payload is persisted server-side, a second authenticated victim who opens the poisoned project file - such as a manager or administrator - has attacker-controlled script run inside their browser session, enabling theft of session cookies or other in-session data. Exploitation requires a valid low-privileged login plus victim interaction (no KEV listing, no public exploit identified at time of analysis, EPSS 0.03% / 9th percentile), so the reporting and the independent re-assessment agree this is a medium-to-low priority issue rather than a mass-exploitation risk.
Stored cross-site scripting in Ekushey CRM 5.0 allows an authenticated user to plant persistent JavaScript in the 'title' and 'description' POST parameters of the project bug creation endpoint (/ekushey/index.php/client/project_bug/create/), which then executes in the browser of any other authenticated user who opens the affected bug record. The root cause is the absence of input validation and output encoding on those fields (CWE-79), rated CVSS 4.0 base 5.1, and exploitation requires both a valid low-privilege login and the victim interacting with the poisoned record, so impact is confined to session/cookie theft in the victim's browser rather than server compromise. No public exploit code has been identified at time of analysis, and EPSS is 0.03% (9th percentile), consistent with a low-priority, interaction-dependent issue.
Stored cross-site scripting in Ekushey Project Manager CRM 5.0 lets an authenticated user inject a malicious payload into the 'message' parameter submitted via POST to /ekushey/index.php/client/project_message/add/xxx, which later executes in the browser of any other authenticated user who opens the affected project message, potentially exposing that user's session cookie. Exploitation requires a valid authenticated account plus a second authenticated victim who actively views the stored message, so impact is confined to the victim's session context rather than the server. No public exploit code has been identified at time of analysis, EPSS is negligible at 0.03% (9th percentile), and the issue is not listed in CISA KEV, making this a low-urgency, medium-severity finding.