CVE-2026-26211
Received Received - Intake

Stored XSS in Ekushey Project Manager CRM Login Page

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the page header. The h4 occurrence is parsed as markup, so HTML placed in the system name field is rendered as markup and any event handler it carries runs. The login page is served without authentication, so the stored value executes in the browser of every visitor who loads it, including visitors who are not signed in, within the origin that serves the login form and alongside the credential fields on it. Storing the value requires an administrator session; the resulting script runs for unauthenticated visitors and persists until the setting is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-26211
EUVD
EUVD-2026-65620

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ekushey project_manager_crm *
creativeitem ekushey_project_manager_crm 5.0
creativeitem ekushey_project_manager_crm From 2015 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Ekushey Project Manager CRM allows an attacker with admin access to inject malicious scripts into the system name field. The script is then executed in the browser of every visitor to the login page, including unauthenticated users, due to improper output encoding.

Detection Guidance

Check the login page HTML source for unencoded system name values in meta description, title, or h4 elements. Inspect for stored HTML or JavaScript in the system name field via admin panel.

Impact Analysis

An attacker could steal session cookies, redirect users to phishing sites, or perform actions on behalf of users. Since the login page is accessible without authentication, all visitors are at risk of script execution.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Remove any HTML or script content from the system name field in the admin panel. Update the CRM to a patched version if available. Monitor login page HTML output for unexpected markup.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart