CVE-2026-66029 in Ekushey Project Manager CRM
Summary
by MITRE • 07/27/2026
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Manage Clients or Manage Client Projects pages where client names are rendered unsanitized.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability represents a critical stored cross-site scripting flaw within the Ekushey Project Manager CRM system, specifically affecting version 5.0 and potentially earlier releases. The security weakness stems from inadequate input validation and sanitization mechanisms implemented within the application's client profile management functionality. When authenticated users with client privileges enter malicious HTML or JavaScript code into the Name field during profile editing, the system fails to properly sanitize this input before storing it in the database. This oversight creates a persistent security risk where malicious payloads become permanently embedded within the application's data store.
The technical execution of this vulnerability occurs through the application's rendering process on pages that display client information. When staff members or administrators navigate to the Manage Clients or Manage Client Projects sections, the stored malicious code is executed within their browser sessions without proper sanitization. This creates a classic stored XSS attack vector where the payload is not only persistent but also capable of affecting multiple users who view the compromised data. The vulnerability leverages the trust relationship between authenticated users and the application's rendering engine, allowing attackers to exploit the system's failure to validate user-supplied input before storage.
The operational impact of this vulnerability extends beyond simple data corruption or display issues, as it provides attackers with persistent access to administrative sessions and potentially sensitive client information. Attackers can craft malicious scripts that perform actions such as stealing session cookies, redirecting users to phishing sites, or executing arbitrary commands within the context of the victim's browser. This capability enables a range of sophisticated attacks including privilege escalation, data exfiltration, and establishment of persistent backdoors within the organization's project management environment. The vulnerability affects not just individual client records but can potentially compromise entire administrative sessions when multiple users view compromised client data.
The security implications align with CWE-79 which specifically addresses cross-site scripting vulnerabilities in web applications, and follows patterns commonly found in the ATT&CK framework under the technique of Web Shell deployment and credential access through persistent browser-based attacks. Organizations utilizing this CRM system face significant risk of unauthorized access to project data, client information, and administrative controls. The vulnerability particularly impacts organizations that rely heavily on client management features and have multiple staff members who regularly access client profile data. Mitigation strategies should include immediate implementation of input sanitization measures, proper HTML escaping of user-supplied content, and comprehensive code review processes to identify similar vulnerabilities throughout the application.
Recommended remediation approaches involve implementing strict input validation at both client and server-side levels, establishing comprehensive output encoding mechanisms for all dynamic content rendering, and conducting thorough security testing including automated scanning and manual penetration testing. Organizations should also implement proper access controls and monitoring mechanisms to detect unusual activities related to client profile modifications. The fix requires modification of the application's data handling processes to ensure that all user-supplied input undergoes appropriate sanitization before being stored in the database, with subsequent rendering processes properly escaping any dynamic content to prevent script execution in browser contexts.