CyberRota Analysis
AI-GeneratedEkushey Project Manager CRM versions up to 5.0 are vulnerable to a stored cross-site scripting (XSS) flaw that allows authenticated users to inject arbitrary HTML and JavaScript into the Reply Ticket field. This vulnerability can lead to the execution of malicious scripts in the browser sessions of Staff or Administrator users accessing the Support Ticket detail page, potentially compromising sensitive information or user accounts. Organizations using this CRM should prioritize remediation to protect against potential exploitation by malicious actors.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.