CVE-2026-66029 Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

PT-2026-65090

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Name...

CVE-2021-41175

Pi-hole's Web interface based on AdminLTE provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8...

CVE-2019-19667

A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP address via RAPR/BlockedClients.html...

CVE-2016-10731

ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...

PT-2014-6079

Name of the Vulnerable Software and Affected Versions TP-LINK N750 Wireless Dual Band Gigabit Router TL-WDR4300 versions prior to firmware 140916 Description The issue is related to a cross-site scripting XSS vulnerability in the DHCP clients page. This allows remote attackers to inject arbitrary...

CVE-2014-4727: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router TL-WDR4300 with firmware before 140916 allows remote attackers to inject arbitrary web script or HTML via the hostname in a DHCP request...