CVE-2025-40989: Stored XSS in Creativeitem Ekushey CRM
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectmessage/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40989?
CVE-2025-40989 is classified as a high-severity vulnerability due to its potential for enabling stored cross-site scripting attacks.
How do I fix CVE-2025-40989?
To fix CVE-2025-40989, ensure proper input validation and sanitization for the 'message' parameter in the affected endpoint.
Which versions of Creativeitem Ekushey CRM are affected by CVE-2025-40989?
CVE-2025-40989 affects Ekushey CRM v5.0 and potentially earlier versions due to similar input handling weaknesses.
Can CVE-2025-40989 be exploited remotely?
Yes, CVE-2025-40989 can be exploited remotely by attackers to inject malicious scripts via the affected 'message' parameter.
What impact does CVE-2025-40989 have on users?
CVE-2025-40989 can allow attackers to execute arbitrary scripts in the context of users' browsers, potentially leading to data theft or session hijacking.