Skip to content
Sign in
5.1 Medium

CVE-2025-40989 Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of…

Description

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_message/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.

Affected products and versions

Product Affected versions Fixed in
Ekushey CRM 5.0 No fix stated

Other CVEs of Ekushey CRM

The 3 CVEs of Ekushey CRM →
CVE-2025-40991 Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of… 5.1 Medium CVE-2025-40990 Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of… 5.1 Medium
Track this CVE