Stored HTML Injection Vulnerability in Perfex CRM by Perfex

CVE-2025-10344

What is CVE-2025-10344?

Perfex CRM v3.2.1 has a stored HTML injection vulnerability that arises from inadequate validation of user input. This security flaw can be exploited by an attacker who sends a specially crafted POST request with manipulated parameters, specifically 'name' and 'clientid', to the '/projects/project/x' endpoint. Successful exploitation may allow the attacker to inject arbitrary HTML content, potentially leading to unauthorized data disclosure or manipulation.

References