CVE-2026-66031
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
Risk Assessment
This vulnerability allows an attacker to steal sessions, take over staff or administrator accounts, and perform actions on their behalf, potentially compromising the CRM system.
Recommendation
Update Ekushey Project Manager CRM to the latest version and implement input validation and sanitization in the Reply Ticket field.
Other vulnerabilities in Ekushey Project Manager CRM
See all- CVE-2026-26211Medium
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places, and the h4 occurrence is parsed as markup, allowing script execution. The login page is served without authentication, so the script runs for every visitor.
- CVE-2026-66030Medium
Ekushey Project Manager CRM version 5.0 and earlier contains a stored cross-site scripting vulnerability. Authenticated client users can inject malicious HTML and JavaScript into the Ticket Title field, which is rendered unsanitized on the Client Support page.
- CVE-2026-66029Medium
Ekushey Project Manager CRM up to version 5.0 contains a stored XSS vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript via the Name field on the Edit Profile page. Malicious scripts execute in browser sessions of Staff or Administrator users viewing the Manage Clients or Manage Client Projects pages.
- CVE-2026-66028Medium
Ekushey Project Manager CRM up to version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password. Attackers can exploit the lack of email field uniqueness to create conflicting account states, leading to unpredictable authentication and unauthorized account access.
Original NVD description (English source)
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.