CVE-2025-40991 — Stored XSS in Creativeitem Ekushey CRM

CVE-2025-40991

Stored XSS in Creativeitem Ekushey CRM PUBLISHED

Description (CNA)

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.

Affected (CNA)

Vendor / product	Versions
Creativeitem / Ekushey CRM	affected 5.0

CWE

CWE-79

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-creativeitem-products

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.