Is CVE-2026-66030 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66030 being exploited in the wild.

How severe is CVE-2026-66030?

Medium severity, with a CVSS score of 5.4, published 27 July 2026.

Which products and versions are affected?

Creativeitem Ekushey Project Manager CRM 0 through 5.0.

Is there a fix for CVE-2026-66030?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66030 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-66030?

Check whether you run Creativeitem Ekushey Project Manager CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66030: Creativeitem Ekushey Project Manager CRM stored XSS in Ticket Title

CVE-2026-66030 · Severity: medium · CVSS 5.4 · Published 2026-07-27

Ekushey Project Manager CRM is a customer relationship management platform used to manage projects and client support tickets. A security flaw allows users with client-level access to embed malicious scripts into support ticket titles. When a staff member or administrator views these tickets, the script executes in their browser, potentially allowing the attacker to perform unauthorized actions or steal session information.

Technologies: Creativeitem Ekushey Project Manager CRM. Vendors: Creativeitem.

Quick answers

Is CVE-2026-66030 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66030 being exploited in the wild.
How severe is CVE-2026-66030?: Medium severity, with a CVSS score of 5.4, published 27 July 2026.
Which products and versions are affected?: Creativeitem Ekushey Project Manager CRM 0 through 5.0.
Is there a fix for CVE-2026-66030?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66030 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66030?: Check whether you run Creativeitem Ekushey Project Manager CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Ekushey Project Manager CRM through version 5.0 due to improper neutralization of input in the 'Ticket Title' field on the 'Create New Ticket' page. An authenticated attacker with client-level privileges can submit a ticket containing a malicious JavaScript payload. This payload is stored in the database and executed in the context of Staff or Administrator users when they view the 'Client Support' or 'All Support Tickets' pages, where the title is rendered without proper sanitization. This can lead to session hijacking or unauthorized administrative actions. No patch has been officially confirmed in the provided advisory.

Affected products

Creativeitem Ekushey Project Manager CRM 0 through 5.0

Timeline

2026-07-25: disclosed: Initial researcher disclosure
2026-07-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.