CVE-2026-66030
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Ekushey Project Manager CRM version 5.0 and earlier contains a stored cross-site scripting vulnerability. Authenticated client users can inject malicious HTML and JavaScript into the Ticket Title field, which is rendered unsanitized on the Client Support page.
Risk Assessment
The risk involves execution of malicious scripts in staff or administrator browsers, potentially leading to session theft, data leakage, or further attacks.
Recommendation
Upgrade Ekushey Project Manager CRM to the latest patched version. As a workaround, restrict access to the Client Support page and implement input/output filtering for ticket title fields.
Other vulnerabilities in Ekushey Project Manager CRM
See all- CVE-2026-26211Medium
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places, and the h4 occurrence is parsed as markup, allowing script execution. The login page is served without authentication, so the script runs for every visitor.
- CVE-2026-66031Medium
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
- CVE-2026-66029Medium
Ekushey Project Manager CRM up to version 5.0 contains a stored XSS vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript via the Name field on the Edit Profile page. Malicious scripts execute in browser sessions of Staff or Administrator users viewing the Manage Clients or Manage Client Projects pages.
- CVE-2026-66028Medium
Ekushey Project Manager CRM up to version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password. Attackers can exploit the lack of email field uniqueness to create conflicting account states, leading to unpredictable authentication and unauthorized account access.
Original NVD description (English source)
Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.