Energy Crm
Monthly
Stored XSS in Energy CRM v2025 (by Status Tracker Ltd) enables session hijacking against authenticated users through unsanitized input accepted at the job creation endpoint. An attacker able to POST a crafted payload to /crm/create_job_submit.php via the JobCreatedBy parameter can persist malicious JavaScript in the CRM database; when an authenticated user subsequently views the affected job record, the script executes in their browser and can exfiltrate session cookies to the attacker. No public exploit code has been identified and no CISA KEV listing exists; EPSS is 0.03% (9th percentile), consistent with the niche deployment footprint of this energy-sector CRM.
Stored XSS in Energy CRM v2025 (by Status Tracker Ltd) enables session hijacking against authenticated users through unsanitized input accepted at the job creation endpoint. An attacker able to POST a crafted payload to /crm/create_job_submit.php via the JobCreatedBy parameter can persist malicious JavaScript in the CRM database; when an authenticated user subsequently views the affected job record, the script executes in their browser and can exfiltrate session cookies to the attacker. No public exploit code has been identified and no CISA KEV listing exists; EPSS is 0.03% (9th percentile), consistent with the niche deployment footprint of this energy-sector CRM.