CVE-2025-40640

MediumCVSS 5.4

Published: 10/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

Energy CRM v2025 by Status Tracker Ltd has a stored XSS vulnerability due to lack of proper validation of user input when sending a POST request to “/crm/create_invoice_submit.php” using the “customerName_0” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Risk Assessment

Cookie session theft can lead to account takeover of an authenticated user, potentially resulting in unauthorized access to data and system functions.

Recommendation

Update Energy CRM to the latest version that includes input validation fixes. Additionally, implement output filtering and encoding mechanisms to prevent XSS.

Other vulnerabilities in Energy CRM

CVE-2025-40643Medium
Energy CRM v2025 by Status Tracker Ltd contains a Stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input by sending a POST request to '/crm/create_job_submit.php' using the 'JobCreatedBy' parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Original NVD description (English source)

Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_invoice_submit.php”, using the “customerName_0” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS