TI-2026-21202 Aliases CVE-2026-26211 GHSA-5p97-43v8-cjrm

Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field

MEDIUM 55CWE-79Published 2026-08-25 · Updated 2026-08-25

Key facts

Attack vector: Network
Privileges required: High
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the page header. The h4 occurrence is parsed as markup, so HTML placed in the system name field is rendered as markup and any event handler it carries runs. The login page is served without authentication, so the stored value executes in the browser of every visitor who loads it, including visitors who are not signed in, within the origin that serves the login form and alongside the credential fields on it. Storing the value requires an administrator session; the resulting script runs for unauthenticated visitors and persists until the setting is changed.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00357 29th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Creativeitem	Ekushey Project Manager CRM	up to 5.0	—	No fix listed	CNA

Ekushey Project Manager CRM VendorCreativeitem Affected up to 5.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-26211
2026-10-03 Alias added: GHSA-5p97-43v8-cjrm

References

Exploit 1

Researcher Disclosure

Other 1

Product Webpage

TI-2025-35404 Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for… CVSS 3.1CRITICAL 9.4
TI-2023-04579 Academy LMS GET Parameter filter sql injection CVSS 3.1CRITICAL 9.8
TI-2026-47017 Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email CVSS 4.0HIGH 7.1
TI-2025-35402 Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation… CVSS 3.1MEDIUM 6.5
TI-2025-35403 Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens… CVSS 3.1MEDIUM 6.4
TI-2025-43319 Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS)… CVSS 3.1MEDIUM 6.1

See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences