CVE-2026-66031
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users
CVSS
5.4
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 27 jul 2026 · Última mod.: 27 jul 2026 · CWE-79
Sin historial EPSS suficiente todavía.
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-654486.5 MED—
———Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions.5hCVE-2026-654477.1 ALT—
———Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.5hCVE-2026-654467.1 ALT—
———Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.5hCVE-2026-654437.1 ALT—
———Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.5hCVE-2026-654417.1 ALT—
———Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.6hCVE-2026-654407.1 ALT—
———Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.6h