Executive brief
Ekushey Project Manager CRM is a business application for project management and customer relationship management. The application allows administrators to configure a system name that gets displayed on the login page and other areas without proper HTML encoding. An attacker with administrator access can inject malicious JavaScript code into the system name field, which then runs in the browser of every visitor—including unauthenticated users viewing the login page—potentially stealing credentials or hijacking sessions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Ekushey Project Manager CRM v5.0, affecting the system name setting (CWE-79). The vulnerable component stores administrator-configured input in the database and renders it without output encoding in three locations: the description meta tag content attribute, the page title element, and an h4 heading element. The h4 element content is parsed as HTML markup, allowing injected event handlers to execute. The login page is publicly accessible without authentication, so stored payloads execute in the browser context of all visitors including unauthenticated users, alongside credential fields. Attack precondition requires administrator session access to modify settings; however, the resulting exploit affects all users and persists until the setting is changed. No patch information is currently available.
Affected products
- Ekushey Project Manager CRM 5.0
Timeline
- 2026-08-01: disclosed: Vulnerability submitted to VulnCheck
- 2026-08: other: VulnCheck validated and CVE assigned
- 2026-08-25: advisory: Public technical disclosure published