CVE-2025-40643

MediumCVSS 5.4

Published: 23/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

Energy CRM v2025 by Status Tracker Ltd contains a Stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input by sending a POST request to '/crm/create_job_submit.php' using the 'JobCreatedBy' parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Risk Assessment

An attacker can steal an authenticated user's session, potentially leading to unauthorized access to the CRM system and data exposure. All installations of Energy CRM v2025 are at risk.

Recommendation

Update Energy CRM to the latest version that fixes the vulnerability, or contact the vendor for a patch. In the meantime, consider implementing additional security measures such as server-side input validation.

Other vulnerabilities in Energy CRM

CVE-2025-40640Medium
Energy CRM v2025 by Status Tracker Ltd has a stored XSS vulnerability due to lack of proper validation of user input when sending a POST request to “/crm/create_invoice_submit.php” using the “customerName_0” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Original NVD description (English source)

Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS