Stored Cross Site Scripting Vulnerability in Ekushey CRM by Creativeitem

CVE-2025-40991

What is CVE-2025-40991?

A stored cross site scripting vulnerability exists in Ekushey CRM v5.0 due to inadequate validation of user inputs. This issue arises specifically when interacting with the '/ekushey/index.php/client/project_file/upload/xxxx' endpoint and affects the 'description' parameter via POST requests. An attacker could exploit this vulnerability by crafting a malicious query directed at an authenticated user, potentially leading to the theft of cookie session details. It is crucial for users to implement proper input validation and security measures to mitigate the risks associated with this vulnerability.

References