CVE-2025-10345
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' and 'address' parameters to the 'admin/leads/lead' endpoint.
Risk Assessment
Malicious HTML stored in the system may be rendered to other users, enabling phishing, content manipulation, or data theft within the victim's browser context. This can undermine trust in the CRM system and expose the organization to social engineering attacks.
Recommendation
Update Perfex CRM to a patched version or implement proper input validation and sanitization for the 'name' and 'address' parameters. It is also advisable to deploy a Content Security Policy (CSP) and review existing data for injected code.
Other vulnerabilities in Perfex CRM
See all- CVE-2025-10346Medium
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knowledge_base/article'.
- CVE-2025-10344Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' and 'clientid' parameters to the '/projects/project/x' endpoint.
- CVE-2025-10343Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'expense_name' parameter to the '/expenses/expense' endpoint.
- CVE-2025-10342Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' parameter to the '/subscriptions/create' endpoint.
- CVE-2025-10341Medium
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint '/clients/client/x'.
Original NVD description (English source)
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'address' at the endpoint 'admin/leads/lead'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS