Read the docs
TI-2026-47017 Aliases CVE-2026-66028GHSA-c8m8-7mj5-r7p7

Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email

Priority MEDIUM 64CWE-303Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00613 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CreativeitemEkushey Project Manager CRMup to 5.0—No fix listedCNA
  • Ekushey Project Manager CRM VendorCreativeitem Affected up to 5.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66028
  2. 2026-10-03 Alias added: GHSA-c8m8-7mj5-r7p7

References

Exploit 1

Other 1

  • TI-2025-35404 Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for… CVSS 3.1CRITICAL 9.4
  • TI-2023-04579 Academy LMS GET Parameter filter sql injection CVSS 3.1CRITICAL 9.8
  • TI-2025-35402 Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation… CVSS 3.1MEDIUM 6.5
  • TI-2025-35403 Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens… CVSS 3.1MEDIUM 6.4
  • TI-2025-43319 Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS)… CVSS 3.1MEDIUM 6.1
  • TI-2024-26120 Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System… CVSS 3.1MEDIUM 6.1
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences