Ekushey Project Manager CRM 5.0 Cross Site Scripting

# CVE-2026-26211 — Stored XSS in Ekushey Project Manager CRM
    
    **Product:** Ekushey Project Manager CRM
    **Version:** 5.0
    **Vulnerability:** Stored Cross-Site Scripting (XSS)
    **CWE:** CWE-79
    **CVE:** CVE-2026-26211
    **Researcher:** LINDAN TRI SAPUTRA
    **Initial Report:** August 1, 2026
    
    ## Summary
    
    A stored Cross-Site Scripting (XSS) vulnerability was identified in Ekushey Project Manager CRM version 5.0.
    
    The issue was found in the application settings, specifically the **Name** field.
    
    User-controlled HTML input can be stored in this field and is later rendered by the application without proper sanitization or output encoding.
    
    ## Affected Component
    
    **Settings → Name**
    
    The configured application name is stored and subsequently displayed in the application interface.
    
    ## Proof of Concept
    
    1. Log in to the application as an administrator.
    2. Navigate to **Settings**.
    3. Locate the **Name** field.
    4. Insert the following harmless XSS test payload:
    
    ```html
    <img src=x onerror=alert(document.domain)>
    ```
    
    5. Save the settings.
    6. Open a page where the configured application name is displayed.
    
    The JavaScript executes when the stored value is rendered.
    
    ## Impact
    
    Because the payload is stored in the application, the issue can affect users other than the administrator who initially modified the setting.
    
    Depending on where the application name is rendered and which users can access those pages, the stored payload may execute in the browser of staff, clients, or other authenticated users.
    
    Potential impact includes:
    
    * Arbitrary JavaScript execution in affected users' browsers
    * Application UI manipulation
    * Phishing or spoofing within the trusted application origin
    * Performing actions within the victim's authenticated application context
    
    ## Video PoC
    
    A video demonstration of CVE-2026-26211 is available here:
    
    [▶ Watch PoC Video on YouTube](https://youtu.be/b8gRD9jpvak?si=otEalAgZexiENIfh)
    
    **Direct video reference:**
    https://youtu.be/b8gRD9jpvak?si=otEalAgZexiENIfh
    
    ## Disclosure Timeline
    
    * **August 1, 2026** — Vulnerability submitted to VulnCheck.
    * **August 2026** — VulnCheck validated the submission as a valid vulnerability and confirmed that it qualifies for CVE assignment.
    * **CVE-2026-26211** — CVE assigned to this vulnerability.
    * **August 25, 2026** — Public technical disclosure published following VulnCheck's request for a public reference.
    
    ## CVE Reference
    
    **CVE-2026-26211**
    
    ## Researcher
    
    **LINDAN TRI SAPUTRA**
    
    Independent Security Researcher