CyberRota Analysis
AI-GeneratedEkushey Project Manager CRM versions up to 5.0 are vulnerable to a stored cross-site scripting (XSS) flaw, allowing authenticated users to inject malicious HTML and JavaScript into the client Name field on the Edit Profile page. This vulnerability can lead to the execution of arbitrary scripts in the browser sessions of Staff or Administrator users, potentially compromising sensitive data or user sessions. Organizations using this CRM should prioritize patching this vulnerability to mitigate the risk of client-side attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Manage Clients or Manage Client Projects pages where client names are rendered unsanitized.