Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field
Priority MEDIUM 56CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Creativeitem | Ekushey Project Manager CRM | up to 5.0 | — | No fix listed | CNA |
- Ekushey Project Manager CRM VendorCreativeitem Affected up to 5.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-66031
- 2026-10-03 Alias added: GHSA-8m4x-pm8r-pc9x
References
Exploit 1
Other 1
More Creativeitem vulnerabilities
- TI-2025-35404 Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for… CVSS 3.1CRITICAL 9.4
- TI-2023-04579 Academy LMS GET Parameter filter sql injection CVSS 3.1CRITICAL 9.8
- TI-2026-47017 Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email CVSS 4.0HIGH 7.1
- TI-2025-35402 Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation… CVSS 3.1MEDIUM 6.5
- TI-2025-35403 Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens… CVSS 3.1MEDIUM 6.4
- TI-2025-43319 Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS)… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-66031 · CVE Program
- CVE-2026-66031 · NVD
- FIRST EPSS
- GHSA-8m4x-pm8r-pc9x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences