CVE-2025-40990CWE-79cross-site-scripting

CVE-2025-40990

Medium · published October 2, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-02T15:15Z
Affected products (1)
ProductVersionsFixed in
creativeitem/ekushey_project_manager_crmall versions—
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-creativeitem-products · [email protected]
EPSS history
Timeline
  • 02 OCT 10:42Z
    Stored XSS in Creativeitem Ekushey CRM
    cvelistv5