CVE-2025-41101
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/projects/save'.
Risk Assessment
An attacker can inject arbitrary HTML, potentially leading to phishing, defacement, or execution of malicious scripts in the user's browser. The risk affects organizations using RISE CRM Framework.
Recommendation
Update RISE CRM Framework to a version containing the fix or implement additional input validation and sanitization. Consider using a WAF to filter malicious requests.
Other vulnerabilities in RISE CRM Framework
See all- CVE-2025-41106Medium
Fairsketch RISE CRM Framework v3.8.1 contains an HTML injection vulnerability due to lack of proper validation of user inputs. An attacker can send a POST request with malicious code in the 'first_name' parameter at '/clients/save_contact/'.
- CVE-2025-41105Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/tickets/save'.
- CVE-2025-41104Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'custom_field_1' in '/estimate_requests/save_estimate_request'.
- CVE-2025-41103Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'reply_message' in '/messages/reply'.
- CVE-2025-41102Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/events/save'.
Original NVD description (English source)
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in'/projects/save'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS