CVE-2025-41103CWE-79cross-site-scripting

CVE-2025-41103

Medium · published November 11, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'reply_message' in '/messages/reply'.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00174 · 6.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-11T18:15Z
Affected products (1)
ProductVersionsFixed in
fairsketch/rise_ultimate_project_manager< 3.93.9
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fairsketchs-rise-crm-framework · [email protected]
EPSS history
Timeline
  • 11 NOV 12:16Z
    Multiple vulnerabilities in Fairsketch's RISE CRM Framework
    cvelistv5