EUVD-2026-49397

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66031 Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66031

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66031

The vulnerability CVE-2026-66031 affects Ekushey Project Manager CRM version 5.0. It is a stored cross-site scripting (XSS) flaw triggered by malicious payloads entered into the Reply Ticket field, executable in the browser sessions of Staff or Administrator users when they view the Support Ticke...

CVE-2026-66031 Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66030

CVE-2026-66030: Ekushey Project Manager CRM (version up to 5.0) contains a stored XSS vulnerability. Authenticated client users can inject HTML/JavaScript into the Ticket Title field on the Create New Ticket page; crafted scripts are stored and may execute in browser sessions of Staff or Administ...

CVE-2026-66030 Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

CVE-2026-66029 Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

EUVD-2026-49393

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

CVE-2026-66029

CVE-2026-66029 affects Ekushey Project Manager CRM up to version 5.0. A stored cross-site scripting (XSS) vulnerability exists in the client management flow: authenticated client users can inject arbitrary HTML/JavaScript by entering payloads into the client Name field on the Edit Profile page, w...

CVE-2026-59239

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

EUVD-2026-49389

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239 Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239 Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239

CVE-2026-59239: Stored XSS in Roskus Prospero Flow CRM 5.4.x email module allows remote, authenticated low-privilege users to inject JavaScript via a stored payload in email bodies, rendered unescaped with {!! $email->body !!} and executable in recipient browsers (including admins), enabling s...

CVE-2026-66390

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

CVE-2026-66390

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

CVE-2026-66390

Apache Wicket contains an XSS vulnerability (CVE-2026-66390) due to improper neutralization of input during web page generation. Affected versions are 9.0.0–9.23.0 and 10.0.0–10.9.0. The issue can be mitigated by upgrading to 10.10.0, which includes the fix. The CVSS 3.1 vector indicates Network ...

CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...