CVE-2025-41106
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Fairsketch RISE CRM Framework v3.8.1 contains an HTML injection vulnerability due to lack of proper validation of user inputs. An attacker can send a POST request with malicious code in the 'first_name' parameter at '/clients/save_contact/'.
Risk Assessment
Injected HTML may execute in the browser of a user viewing the affected page, potentially leading to phishing, session theft, or content modification. The risk affects RISE CRM installations at version 3.8.1.
Recommendation
Update RISE CRM Framework to a version containing the fix or implement input validation and encoding for the 'first_name' parameter. Until then, restrict access to the contact saving functionality.
Other vulnerabilities in RISE CRM Framework
See all- CVE-2025-41105Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/tickets/save'.
- CVE-2025-41104Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'custom_field_1' in '/estimate_requests/save_estimate_request'.
- CVE-2025-41103Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'reply_message' in '/messages/reply'.
- CVE-2025-41102Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/events/save'.
- CVE-2025-41101Medium
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/projects/save'.
Original NVD description (English source)
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'first_name' in '/clients/save_contact/'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS