Description (CNA)
A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate module. As a result, arbitrary HTML can be injected and rendered unescaped in client-facing documents.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://codecanyon.net/item/perfex-powerful-open-source-crm/14013737
- https://github.com/ajansha/CVE-2025-55903
ADP enrichment
No English description supplied.
No references supplied.