CVE-2026-4165 — Worksuite HR, CRM and Project Management create cross site scripting

Description (CNA)

A vulnerability has been found in Worksuite HR, CRM and Project Management up to 5.5.25. The affected element is an unknown function of the file /account/orders/create. The manipulation of the argument Client Note leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected (CNA)

Vendor / product	Versions
Worksuite / HR, CRM and Project Management	affected 5.5.0; affected 5.5.1; affected 5.5.2; affected 5.5.3; affected 5.5.4; affected 5.5.5; affected 5.5.6; affected 5.5.7; affected 5.5.8; affected 5.5.9; affected 5.5.10; affected 5.5.11; affected 5.5.12; affected 5.5.13; affected 5.5.14; affected 5.5.15; affected 5.5.16; affected 5.5.17; affected 5.5.18; affected 5.5.19; affected 5.5.20; affected 5.5.21; affected 5.5.22; affected 5.5.23; affected 5.5.24; affected 5.5.25

Vendor / product

Versions

Worksuite / HR, CRM and Project Management

affected 5.5.0; affected 5.5.1; affected 5.5.2; affected 5.5.3; affected 5.5.4; affected 5.5.5; affected 5.5.6; affected 5.5.7; affected 5.5.8; affected 5.5.9; affected 5.5.10; affected 5.5.11; affected 5.5.12; affected 5.5.13; affected 5.5.14; affected 5.5.15; affected 5.5.16; affected 5.5.17; affected 5.5.18; affected 5.5.19; affected 5.5.20; affected 5.5.21; affected 5.5.22; affected 5.5.23; affected 5.5.24; affected 5.5.25

CWE

CWE-79, CWE-94

References

https://vuldb.com/?id.351072
https://vuldb.com/?ctiid.351072
https://vuldb.com/?submit.769430

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.