Stored XSS in Ekushey Project Manager CRM Affected by Improper Output Encoding
CVE-2026-26211

4.8MEDIUM

Key Information:

Vendor: Creativeitem
Status: Ekushey Project Manager Crm
Vendor: CVE Published:; 25 August 2026

🔔 Create Creativeitem Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-26211?

The Ekushey Project Manager CRM contains a vulnerability that allows stored Cross-Site Scripting (XSS) attacks through improper output encoding of the administrator-configured system name. When this name is displayed on the login page, it is rendered without adequate encoding, permitting any HTML code stored within it to execute. This behavior exposes unauthorized visitors to potential malicious scripts when they access the login page, which does not require authentication. Attackers can exploit this vulnerability by manipulating the system name during an administrator session, which will persist and affect all future visitors until the system name is modified.

Affected Version(s)

Ekushey Project Manager CRM 0 <= 5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-26211 - Proof of Concept