CVE-2026-66028
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Ekushey Project Manager CRM up to version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password. Attackers can exploit the lack of email field uniqueness to create conflicting account states, leading to unpredictable authentication and unauthorized account access.
Risk Assessment
The organization risks unauthorized access to client accounts and unpredictable authentication behavior, potentially compromising data integrity.
Recommendation
Update the CRM to a patched version or add a uniqueness constraint for email addresses in the database.
Other vulnerabilities in Ekushey Project Manager CRM
See all- CVE-2026-26211Medium
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places, and the h4 occurrence is parsed as markup, allowing script execution. The login page is served without authentication, so the script runs for every visitor.
- CVE-2026-66031Medium
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
- CVE-2026-66030Medium
Ekushey Project Manager CRM version 5.0 and earlier contains a stored cross-site scripting vulnerability. Authenticated client users can inject malicious HTML and JavaScript into the Ticket Title field, which is rendered unsanitized on the Client Support page.
- CVE-2026-66029Medium
Ekushey Project Manager CRM up to version 5.0 contains a stored XSS vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript via the Name field on the Edit Profile page. Malicious scripts execute in browser sessions of Staff or Administrator users viewing the Manage Clients or Manage Client Projects pages.
Original NVD description (English source)
Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access.