CVE-2026-66031
Received Received - Intake

Stored XSS in Ekushey Project Manager CRM

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66031
EUVD
EUVD-2026-49397

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ekushey project_manager_crm 5.0
creativeitem ekushey_project_manager_crm to 5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66031 is a stored cross-site scripting (XSS) vulnerability in Ekushey Project Manager CRM version 5.0 or earlier. Authenticated client users can inject malicious HTML or JavaScript by entering harmful payloads into the Reply Ticket field. When staff or administrator users view the Support Ticket detail page, the stored scripts execute in their browser sessions.

Detection Guidance

To detect this stored XSS vulnerability in Ekushey Project Manager CRM, inspect ticket replies for malicious payloads in the Reply Ticket field. Check browser console logs for script execution when viewing Support Ticket pages. Manually review stored ticket content for unusual HTML or JavaScript tags like <script>, <img>, or event handlers.

Impact Analysis

This vulnerability allows attackers to compromise accounts of staff or admin users who view ticket details. Malicious scripts could steal session cookies, redirect users to phishing sites, or perform actions on their behalf. It may lead to unauthorized data access, account takeover, or further exploitation of the CRM system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized script execution in user sessions. Stored XSS may lead to data theft, session hijacking, or unauthorized access to sensitive information, which violates confidentiality requirements in both regulations.

Mitigation Strategies

Immediately update Ekushey Project Manager CRM to the latest version beyond 5.0. Implement strict input validation to block HTML/JS in ticket replies. Sanitize all user inputs before storage and rendering. Restrict client user permissions to minimize impact if exploitation occurs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66031. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart