CyberRota Analysis
AI-GeneratedThe Ekushey Project Manager CRM, up to version 5.0, is vulnerable to a stored cross-site scripting (XSS) flaw that allows authenticated users to inject malicious HTML and JavaScript into the Ticket Title field. This vulnerability can lead to the execution of arbitrary scripts in the browsers of Staff or Administrator users when they access the Client Support page, potentially compromising sensitive information or user sessions. Organizations using this CRM should prioritize patching this vulnerability to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.