Medium severity · published Oct 19, 2018
CVE-2018-18417
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the…
5.4
CVSS
1.6%
EPSS
No
On KEV
Description
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Ekushey Project Manager · Creativeitem
3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-18417
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-18417
Exploit
http://packetstormsecurity.com/files/149842/Ekushey-Project-Manager-CRM-3.1-Cross-Site-Scripting.html
Exploit
https://www.exploit-db.com/exploits/45681/
More from Ekushey Project Manager
6.1
CVE-2023-3754
A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0