CVE-2026-66030: Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field
Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.
Other sources
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ekushey Project Manager CRMto a version that resolves this vulnerability.Fixed in 5.0 - Configuration
Ensure ticket titles submitted in the Ticket Title field are properly sanitized/encoded before being rendered on the Client Support page to prevent stored XSS execution in Staff/Administrator browser sessions.
Ekushey Project Manager CRM (Create New Ticket page) Ticket Title field input handling (sanitize/encode before rendering) = Unsanitized
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66030?
CVE-2026-66030 has a medium severity rating of 5.4.
How do I fix CVE-2026-66030?
To fix CVE-2026-66030, the Ekushey Project Manager CRM needs to be updated to a version greater than 5.0 that addresses this stored XSS vulnerability.
What type of vulnerability is CVE-2026-66030?
CVE-2026-66030 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-66030?
Authenticated client users of Ekushey Project Manager CRM version 5.0 are affected by CVE-2026-66030.
What impacts does CVE-2026-66030 have on users?
CVE-2026-66030 allows attackers to inject arbitrary HTML and JavaScript into the system, potentially compromising user data and functionality.