Ekushey Project Manager CRM Stored XSS in Client Name

Executive Summary

CVE-2026-66029 is a stored cross-site scripting (XSS) vulnerability in Ekushey Project Manager CRM version 5.0 or earlier. Authenticated client users can inject malicious HTML or JavaScript by entering unsanitized payloads into the client Name field on the Edit Profile page. The injected scripts execute when staff or administrator users view the Manage Clients or Manage Client Projects pages where client names are displayed without sanitization.

Useful 0 Not Useful 0

Detection Guidance

To detect this stored XSS vulnerability, inspect the Ekushey Project Manager CRM application for unsanitized client names in the Edit Profile page. Check if malicious payloads like <script>alert('test')</script> are stored and rendered unsanitized in the Manage Clients or Manage Client Projects pages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the browsers of staff or administrator users. This could lead to session hijacking, unauthorized actions on behalf of users, theft of sensitive data, or further compromise of the application. Users viewing affected pages may unknowingly trigger the stored scripts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using the affected software may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Ekushey Project Manager CRM to the latest patched version if available. As a temporary mitigation, sanitize all user inputs, particularly the client Name field, to prevent script injection. Restrict client user privileges to minimize potential impact.

Useful 0 Not Useful 0