67 matches found
CVE-2026-26211
CVE-2026-26211 — XSS stocké dans Ekushey Project Manager CRM Produit : Ekushey Project Manager CRM Version : 5.0 Vulnérabilité : Cross-Site Scripting XSS stocké CWE : CWE-79 CVE : CVE-2026-26211 Chercheur : LINDAN TRI SAPUTRA Rapport initial : 1er août 2026 Résumé Une vulnérabilité de Cross-Site...
EUVD-2026-65620
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the pa...
CVE-2026-26211
Ekushey Project Manager CRM 5.0 is affected by a stored XSS vulnerability in the administrator-configured system name field. The value is written to the login page without output encoding, and its occurrence in an h4 element is parsed as markup, causing any injected HTML event handlers to execute...
Ekushey Project Manager CRM 5.0 Cross Site Scripting
A persistent cross site scripting vulnerability was identified in Ekushey Project Manager CRM version 5.0. The issue was found in the application settings, specifically the Name field. CVE-2026-26211 — Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0...
CVE-2026-66031
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...
CVE-2026-66029
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...
EUVD-2026-49397
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...
CVE-2026-66031 Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...
CVE-2026-66031
The vulnerability CVE-2026-66031 affects Ekushey Project Manager CRM version 5.0. It is a stored cross-site scripting (XSS) flaw triggered by malicious payloads entered into the Reply Ticket field, executable in the browser sessions of Staff or Administrator users when they view the Support Ticke...
CVE-2026-66030
CVE-2026-66030: Ekushey Project Manager CRM (version up to 5.0) contains a stored XSS vulnerability. Authenticated client users can inject HTML/JavaScript into the Ticket Title field on the Create New Ticket page; crafted scripts are stored and may execute in browser sessions of Staff or Administ...
CVE-2026-66030
Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...
CVE-2026-66029 Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...
CVE-2026-66028 Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email
Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement t...
PT-2026-65095
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...
PT-2026-65091
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Ticket...
EUVD-2018-10146
Malware in sbrugna...
CVE-2025-40989
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectmessage/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a speciall...
EUVD-2025-32104
Malicious code in bioql PyPI...