CVE-2025-40989
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Stored XSS vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper input validation in '/ekushey/index.php/client/project_message/add/xxx', affecting the 'message' parameter via POST. Allows a remote attacker to send a crafted query to an authenticated user and steal cookie session details.
Risk Assessment
An attacker could hijack an authenticated user's session, potentially leading to unauthorized data access and system integrity compromise.
Recommendation
Update Ekushey CRM to the latest version and implement input validation and sanitization for the 'message' parameter.
Other vulnerabilities in Ekushey CRM
See all- CVE-2025-40991Medium
Stored XSS vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper input validation in '/ekushey/index.php/client/project_file/upload/xxxx', affecting the 'description' parameter via POST. Allows a remote attacker to send a crafted query to an authenticated user and steal cookie session details.
- CVE-2025-40990Medium
Ekushey CRM v5.0 by Creativeitem has a stored XSS vulnerability due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Original NVD description (English source)
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_message/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS