CVE-2025-10346
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knowledge_base/article'.
Risk Assessment
An attacker could inject arbitrary HTML that is displayed to other users, potentially used for phishing or content manipulation. This may undermine trust in the system and expose users to fraud.
Recommendation
Update Perfex CRM to a version later than 3.2.1 that contains the fix. Until then, implement additional input validation and sanitization, especially for the 'subject' parameter.
Other vulnerabilities in Perfex CRM
See all- CVE-2025-10345Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' and 'address' parameters to the 'admin/leads/lead' endpoint.
- CVE-2025-10344Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' and 'clientid' parameters to the '/projects/project/x' endpoint.
- CVE-2025-10343Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'expense_name' parameter to the '/expenses/expense' endpoint.
- CVE-2025-10342Medium
Perfex CRM v3.2.1 contains a stored HTML injection vulnerability due to lack of proper validation of user input. The injection occurs by sending a POST request with the 'name' parameter to the '/subscriptions/create' endpoint.
- CVE-2025-10341Medium
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint '/clients/client/x'.
Original NVD description (English source)
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knoewledge_base/article'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS