Stored Cross-Site Scripting Vulnerability in Ekushey Project Manager CRM
CVE-2026-66029

5.1MEDIUM

Key Information:

Vendor: Creativeitem
Status: Ekushey Project Manager Crm
Vendor: CVE Published:; 27 July 2026

🔔 Create Creativeitem Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-66029?

The Ekushey Project Manager CRM, up to version 5.0, is vulnerable to a stored cross-site scripting issue. This vulnerability allows authenticated users to enter malicious HTML and JavaScript code into the client Name field within the Edit Profile page without proper input sanitization. As a result, attackers can inject and store harmful scripts that may be executed in the browser sessions of Staff or Administrator users when they access the Manage Clients or Manage Client Projects pages, where client information is displayed unsanitized. This security flaw can lead to unauthorized actions or data exposure, underscoring the need for prompt remediation efforts.

Affected Version(s)

Ekushey Project Manager CRM 0 <= 5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-66029 - Proof of Concept