CVE-2026-66030— Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Creativeitem | Ekushey Project Manager CRM | ≤ 5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-66030
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field
Source: CVE Program / CVE List V5
Vulnerability Description
Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Creativeitem | Ekushey Project Manager CRM | 0 ~ 5.0 | - |
II. Public POCs for CVE-2026-66030
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66030
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-66030 (1)
Proof of Concept for CVE-2026-66030 (1)
- 🔗 CVE-Disclosures/CVE-2026/CVE-2026-66030 at main · aaronamran/CVE-Disclosures · GitHub Read full article technical-descriptionexploit
Same Patch Batch · Creativeitem · 2026-07-27 · 4 CVEs total
| CVE-2026-66028 | 6.7 MEDIUM | Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email |
| CVE-2026-66029 | 5.4 MEDIUM | Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field |
| CVE-2026-66031 | 5.4 MEDIUM | Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field |
IV. Related Vulnerabilities
Same product: Ekushey Project Manager CRM
Same vendor: Creativeitem
- CVE-2026-66031
Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket - CVE-2026-66029
Ekushey Project Manager CRM 5.0 Stored XSS via Client Name F - CVE-2026-66028
Ekushey Project Manager CRM 5.0 Missing Uniqueness Constrain - CVE-2023-53876
Academy LMS 6.1 Arbitrary File Upload Vulnerability via Prof - CVE-2025-40992
Stored XSS in Creativeitem Sociopro
Same weakness: CWE-79
- CVE-2026-67617
Microweber CMS 2.0.20 Stored XSS via tag_names Parameter - CVE-2026-18682
OpenAkita File Upload API upload cross site scripting - CVE-2026-49132
OPNsense < 26.1.9 Stored XSS via Certificate Description Fie - CVE-2026-49131
OPNsense < 26.1.9 Stored XSS via Firewall Rule Description F - CVE-2026-66296
Reflected XSS in oaskit's default HTML error handler
V. Comments for CVE-2026-66030
No comments yet