CVE-2025-40990
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Ekushey CRM v5.0 by Creativeitem has a stored XSS vulnerability due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Risk Assessment
Cookie session theft can lead to account takeover, potentially resulting in unauthorized access to data and system functions.
Recommendation
Update Ekushey CRM to the latest version that includes input validation fixes. Additionally, implement output filtering and encoding mechanisms to prevent XSS.
Other vulnerabilities in Ekushey CRM
See all- CVE-2025-40991Medium
Stored XSS vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper input validation in '/ekushey/index.php/client/project_file/upload/xxxx', affecting the 'description' parameter via POST. Allows a remote attacker to send a crafted query to an authenticated user and steal cookie session details.
- CVE-2025-40989Medium
Stored XSS vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper input validation in '/ekushey/index.php/client/project_message/add/xxx', affecting the 'message' parameter via POST. Allows a remote attacker to send a crafted query to an authenticated user and steal cookie session details.
Original NVD description (English source)
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS