CVE-2026-66030
Received Received - Intake

Stored XSS in Ekushey Project Manager CRM

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66030
EUVD
EUVD-2026-49395

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ekushey project_manager_crm to 5.0 (inc)
creativeitem ekushey_project_manager_crm to 5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Ekushey Project Manager CRM version 5.0 or earlier. It allows authenticated users to inject malicious HTML or JavaScript code by entering harmful payloads into the Ticket Title field on the Create New Ticket page. The injected scripts are stored and executed when other users, such as Staff or Administrators, view the Client Support page where ticket titles are displayed without proper sanitization.

Detection Guidance

To detect this vulnerability, inspect the Ticket Title field in the Create New Ticket page for stored XSS payloads. Check if malicious scripts are rendered unsanitized on the Client Support page. Manually review ticket titles for unusual HTML or JavaScript content.

Impact Analysis

This vulnerability can impact you by allowing attackers to execute malicious scripts in your browser sessions. If you are a Staff or Administrator user viewing the Client Support page, the injected scripts could steal session cookies, redirect you to phishing sites, or perform actions on your behalf without your knowledge. It compromises the security of your interactions with the CRM system.

Compliance Impact

This vulnerability can negatively impact compliance with GDPR and HIPAA by exposing sensitive user data to potential theft or manipulation. GDPR requires protecting personal data, and a stored XSS flaw could lead to unauthorized access or data breaches. HIPAA mandates safeguarding protected health information, which could be compromised if attackers exploit this vulnerability to access or alter data.

Mitigation Strategies

Apply input validation to sanitize the Ticket Title field. Ensure all user inputs are properly escaped before rendering. Update to the latest patched version of Ekushey Project Manager CRM if available. Restrict user permissions to minimize impact of potential exploits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart