CVE-2025-60378: XSS
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60378?
CVE-2025-60378 is rated as a high severity vulnerability due to its potential for serious exploitation, such as phishing and credential theft.
How can I mitigate the risks associated with CVE-2025-60378?
To mitigate CVE-2025-60378, ensure that input validation is properly implemented to prevent HTML injection.
What types of attacks can CVE-2025-60378 enable?
CVE-2025-60378 can enable attacks such as phishing, credential theft, and business email compromise due to the injection of malicious HTML.
Who is affected by CVE-2025-60378?
CVE-2025-60378 affects authenticated users of the RISE Ultimate Project Manager & CRM who can inject arbitrary HTML into invoices and messages.
Is there a patch available for CVE-2025-60378?
Currently, there is no official patch for CVE-2025-60378, so implementing secure coding practices is essential until a fix is released.