TI-2026-47019 Aliases CVE-2026-66030 GHSA-jj3m-h8qh-92r4

Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field

MEDIUM 56CWE-79Published 2026-07-27 · Updated 2026-07-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00289 21st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Creativeitem	Ekushey Project Manager CRM	up to 5.0	—	No fix listed	CNA

Ekushey Project Manager CRM VendorCreativeitem Affected up to 5.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-66030
2026-10-03 Alias added: GHSA-jj3m-h8qh-92r4

References

Exploit 1

Researcher Disclosure

Other 1

Product Webpage

TI-2025-35404 Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for… CVSS 3.1CRITICAL 9.4
TI-2023-04579 Academy LMS GET Parameter filter sql injection CVSS 3.1CRITICAL 9.8
TI-2026-47017 Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email CVSS 4.0HIGH 7.1
TI-2025-35402 Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation… CVSS 3.1MEDIUM 6.5
TI-2025-35403 Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens… CVSS 3.1MEDIUM 6.4
TI-2025-43319 Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS)… CVSS 3.1MEDIUM 6.1

See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences