CVE-2025-41103
BaseFortify
Publication date: 2025-11-11
Last updated on: 2025-11-17
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fairsketch | rise_ultimate_project_manager | to 3.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can allow attackers to inject malicious HTML code, which may lead to issues such as content manipulation, phishing attacks, or other forms of client-side code execution. This can compromise the integrity and security of the application and potentially affect users interacting with it.
Can you explain this vulnerability to me?
This vulnerability is an HTML injection issue in Fairsketch's RISE CRM Framework version 3.8.1. It occurs because the application does not properly validate user inputs in the 'reply_message' parameter when a POST request is sent to '/messages/reply'. This allows an attacker to inject malicious HTML code.