HTML Injection in Fairsketch RISE CRM Framework Affects User Input Validation

CVE-2025-41104

What is CVE-2025-41104?

An HTML injection vulnerability exists in Fairsketch's RISE CRM Framework version 3.8.1, resulting from insufficient validation of user inputs. The vulnerability is triggered through a POST request that manipulates the 'custom_field_1' parameter in the '/estimate_requests/save_estimate_request' endpoint. Attackers exploiting this weakness could inject malicious HTML content, potentially leading to unauthorized access or manipulation of application behavior.

References