CVE-2025-10343: HTML injection in Perfex CRM
Published Sep 29, 2025
·Updated
HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'expensename' at the endpoint '/expenses/expense'.
Affected Software
2 affected components
Perfex CRM
Perfexcrm Perfex Crm>=3.2.1<3.4.0
Event History
Sep 29, 2025
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
DescriptionWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-10343?
CVE-2025-10343 is classified as a medium-severity HTML injection vulnerability.
2
How do I fix CVE-2025-10343?
To fix CVE-2025-10343, ensure proper validation and sanitization of user inputs at the '/expenses/expense' endpoint.
3
What versions of Perfex CRM are affected by CVE-2025-10343?
Perfex CRM version 3.2.1 is specifically affected by CVE-2025-10343.
4
What kind of attack can be executed using CVE-2025-10343?
CVE-2025-10343 allows for stored HTML injection, which can lead to the execution of malicious scripts in the application.
5
Is user authentication sufficient to mitigate CVE-2025-10343?
No, user authentication alone is insufficient; proper input validation and sanitization are crucial to mitigate CVE-2025-10343.