CVE-2026-66029
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Ekushey Project Manager CRM up to version 5.0 contains a stored XSS vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript via the Name field on the Edit Profile page. Malicious scripts execute in browser sessions of Staff or Administrator users viewing the Manage Clients or Manage Client Projects pages.
Risk Assessment
The organization risks session theft, account takeover of staff or administrators, and leakage of CRM data.
Recommendation
Update the CRM to a patched version or apply input filtering and output encoding for client name fields.
Other vulnerabilities in Ekushey Project Manager CRM
See all- CVE-2026-26211Medium
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places, and the h4 occurrence is parsed as markup, allowing script execution. The login page is served without authentication, so the script runs for every visitor.
- CVE-2026-66031Medium
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
- CVE-2026-66030Medium
Ekushey Project Manager CRM version 5.0 and earlier contains a stored cross-site scripting vulnerability. Authenticated client users can inject malicious HTML and JavaScript into the Ticket Title field, which is rendered unsanitized on the Client Support page.
- CVE-2026-66028Medium
Ekushey Project Manager CRM up to version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password. Attackers can exploit the lack of email field uniqueness to create conflicting account states, leading to unpredictable authentication and unauthorized account access.
Original NVD description (English source)
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Manage Clients or Manage Client Projects pages where client names are rendered unsanitized.