PoC Index85,092 CVEs with PoCs

CVE-2026-66030

Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field

MEDIUM 5.1EPSS 0.3%

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.

Affected
Creativeitem · Ekushey Project Manager CRM
CVSS v4.0 VULNCHECK
5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK
5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.29% chance of exploitation in the next 30 days, 20th percentile
Published
2026-07-27
Updated
2026-07-28

Proof-of-concept exploits (1)

References

Related