CVE-2026-66029: Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Manage Clients or Manage Client Projects pages where client names are rendered unsanitized.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66029?
The severity of CVE-2026-66029 is classified as medium with a score of 5.4.
How do I fix CVE-2026-66029?
To fix CVE-2026-66029, ensure that input in the client Name field is properly sanitized and validated to prevent stored XSS.
What type of vulnerability is CVE-2026-66029?
CVE-2026-66029 is a stored cross-site scripting (XSS) vulnerability affecting Ekushey Project Manager CRM.
Who is affected by CVE-2026-66029?
Authenticated client users of Ekushey Project Manager CRM version 5.0 are affected by CVE-2026-66029.
What impact does CVE-2026-66029 have on users?
CVE-2026-66029 allows attackers to inject arbitrary HTML and JavaScript into the application, which can lead to session hijacking or data theft.