CVE-2025-40990: Stored XSS in Creativeitem Ekushey CRM
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectbug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40990?
CVE-2025-40990 is classified as a medium severity stored Cross Site Scripting (XSS) vulnerability.
How do I fix CVE-2025-40990?
To fix CVE-2025-40990, ensure proper validation and sanitization of user inputs, particularly for the 'title' and 'description' parameters.
What software versions are affected by CVE-2025-40990?
CVE-2025-40990 affects Ekushey CRM v5.0 by Creativeitem.
What impact does CVE-2025-40990 have?
CVE-2025-40990 can allow remote attackers to execute malicious scripts in the context of the user's session.
Where in the application does CVE-2025-40990 occur?
CVE-2025-40990 occurs in the '/ekushey/index.php/client/project_bug/create/' endpoint when handling POST requests.