CVE-2026-66030

· MEDIUMDeferred

← All CVEs

CVSS v3.1

5.4

CVSS v4.0

5.1

EPSS

0.17%

Published

Jul 27, 2026

Modified

Jul 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

References (3)

https://codecanyon.net/item/ekushey-project-manager-crm/9492104

https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-66030

https://www.vulncheck.com/advisories/ekushey-project-manager-crm-stored-xss-via-ticket-title-field

KEV Catalog EPSS Scores Vendors All CVEs