Ekushey Project Manager Crm
Approved changes feed: RSS · Atom
cpe:2.3:a:creativeitem:ekushey_project_manager_crm:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Creativeitem (3eda3dd0-95df-519c-b7c3-66479e67a88a) |
|---|---|
| Product | Ekushey Project Manager Crm (4752bd07-772f-520b-a1f7-a5ab8c90fbc3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-66029 |
vulnerable | 2026-07-29 01:06:20.295742 |
Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field
MEDIUM (5.4)
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Manage Clients or Manage Client Projects pages where client names are rendered unsanitized.
Published: 2026-07-27T18:02:41.989Z
Updated: 2026-07-28T14:07:29.468Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3754 |
vulnerable | 2026-06-08 06:09:40.426387 |
Creativeitem Ekushey Project Manager CRM xxxxxxxx[random-msg-hash] cross site scripting
LOW (3.5)
A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0. Affected is an unknown function of the file /index.php/client/message/message_read/xxxxxxxx[random-msg-hash]. The manipulation of the argument message leads to cross site scripting. It is possible to launch the attack remotely. VDB-234426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2023-07-19T03:00:05.454Z
Updated: 2024-08-02T07:08:48.997Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.