CVE-2026-36392

Received Received - Intake

Cross-Site Scripting (XSS) in FairSketch Rise CRM

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MITRE

Description

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, account takeover, and phishing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-36392

Affected Vendors & Products

Vendor	Product	Version / Range
fairskech	rise_crm	3.9.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

FairSketch Rise CRM Version 3.9.6 has a Cross Site Scripting (XSS) vulnerability. An authenticated administrator can inject malicious JavaScript into an item's title. This script is stored on the server and executed in the browser of any user visiting the affected page, potentially leading to session hijacking or account takeover.

Detection Guidance

To detect this XSS vulnerability in FairSketch Rise CRM Version 3.9.6, inspect the item titles in the admin panel for suspicious JavaScript code. Check the browser console for executed scripts when visiting store pages. Look for unexpected redirects or pop-ups indicating malicious payloads.

Impact Analysis

This vulnerability allows attackers to steal user sessions, take over accounts, or launch phishing attacks. Users visiting compromised pages may have their sessions hijacked or credentials stolen without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage if exploited.

Mitigation Strategies

Immediately update FairSketch Rise CRM to the latest patched version. If no patch exists, disable the ability for administrators to inject JavaScript into item titles. Implement input validation to strip or escape script tags in titles. Monitor network traffic for unusual activity.

Hi! I’m here to help you understand CVE-2026-36392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70