Medium severity · published Jul 27, 2026
CVE-2026-66031
Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Ekushey Project Manager CRM · Creativeitem
through 5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66031
codecanyon.net
https://codecanyon.net/item/ekushey-project-manager-crm/9492104
github.com
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-66031
www.vulncheck.com
https://www.vulncheck.com/advisories/ekushey-project-manager-crm-stored-xss-via-reply-ticket-field
More from Ekushey Project Manager CRM
6.7
CVE-2026-66028
Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email
5.4
CVE-2026-66030
Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field
5.4
CVE-2026-66029
Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field
5.4
CVE-2025-40991
Stored XSS in Creativeitem Ekushey CRM
5.4
CVE-2025-40990
Stored XSS in Creativeitem Ekushey CRM