HTML Injection Vulnerability in Perfex CRM by Perfex

CVE-2025-10345

What is CVE-2025-10345?

An HTML injection vulnerability exists in Perfex CRM v3.2.1, enabling attackers to exploit the system through stored input. This issue arises due to inadequate validation of user input when parameters such as 'name' and 'address' are sent via a POST request to the 'admin/leads/lead' endpoint. As a result, malicious HTML content can be injected, potentially compromising the integrity and security of the application. It is crucial for users of Perfex CRM to review and strengthen their input validation mechanisms to mitigate this risk.

References